Chuanhuchatgpt
Approved changes feed: RSS · Atom
cpe:2.3:a:gaizhenbiao:chuanhuchatgpt:2024-09-19:*:*:*:*:*:*:*
part: a version: 2024-09-19 update: *
| Vendor | Gaizhenbiao (09e6d600-4bf0-5c06-a546-cd3bdcc3d6c8) |
|---|---|
| Product | Chuanhuchatgpt (63cd33cc-2b52-5d56-9739-278fa042d4d6) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/gaizhenbiao/chuanhuchatgpt |
purl2cpe | 2026-06-01 10:12:59.971318 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-9107 |
vulnerable | 2026-06-08 07:00:26.667404 |
Stored XSS in gaizhenbiao/chuanhuchatgpt
MEDIUM (6.8)
A stored cross-site scripting (XSS) vulnerability exists in the gaizhenbiao/chuanhuchatgpt repository, affecting version git 20b2e02. The vulnerability arises from improper sanitization of HTML tags in chat history uploads. Specifically, the sanitization logic fails to handle HTML tags within code blocks correctly, allowing an attacker to inject malicious scripts. This can lead to the execution of arbitrary JavaScript code in the context of the user's browser, potentially leading to identity theft or other malicious actions.
Published: 2025-03-20T10:10:12.783Z
Updated: 2025-03-20T18:24:36.444Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-10955 |
vulnerable | 2026-06-08 06:23:48.266362 |
ReDoS (Regular Expression Denial of Service) in gaizhenbiao/chuanhuchatgpt
MEDIUM (6.5)
A Regular Expression Denial of Service (ReDoS) vulnerability exists in gaizhenbiao/chuanhuchatgpt, as of commit 20b2e02. The server uses the regex pattern `r'<[^>]+>'` to parse user input. In Python's default regex engine, this pattern can take polynomial time to match certain crafted inputs. An attacker can exploit this by uploading a malicious JSON payload, causing the server to consume 100% CPU for an extended period. This can lead to a Denial of Service (DoS) condition, potentially affecting the entire server.
Published: 2025-03-20T10:11:01.287Z
Updated: 2025-10-15T12:50:14.963Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.