CVE-2025-0747 - Stored Cross-Site vulnerability in EmbedAI

Back Back to CVE browser

HIGH

Stored Cross-Site vulnerability in EmbedAI

Published Jan 30, 2025

8.6

HIGH

CVSS 3.1

EPSS 0.24%

Description

A Stored Cross-Site Scripting vulnerability has been found in EmbedAI. This vulnerability allows an authenticated attacker to inject a malicious JavaScript code into a message that will be executed when a user opens the chat.

Affected products

Vendor EmbedAI Product EmbedAI Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <2.1

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

EmbedAI

unaffected

Version	Status	Constraints
0	affected	<2.1

Remediation

Vendor solution

The vulnerability has been resolved by EmbedAI team in version 2.1.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-1851
Advisory
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-embedai
Third Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-1851		Advisory
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-embedai		Third Party Advisory