Danswer-ai vulnerabilities
We track 8 vulnerabilities in Danswer-ai products across 2 products. 8 are rated high or critical, and none are known to be exploited. The most recent was published on March 20, 2025.
Latest Danswer-ai vulnerabilities
- 7.5 High severity
danswer-ai/danswer: Allocation of Resources Without Limits or Throttling
A vulnerability in danswer-ai/danswer version 0.9.0 allows for denial of service through memory exhaustion. The issue arises from the use of a vulnerable version of the starlette package (<=0.49) via fastapi, which was patched in fastapi version 0.115.3. The v
- 8.1 High severity
danswer-ai/danswer: Cross-Site Request Forgery
A Cross-Site Request Forgery (CSRF) vulnerability in version v1.4.1 of danswer-ai/danswer allows attackers to perform unauthorized actions in the context of the victim's browser. This includes connecting the victim's application with a malicious Slack Bot, inv
- 7.5 High severity
danswer-ai/danswer: Allocation of Resources Without Limits or Throttling
A vulnerability in danswer-ai/danswer v0.3.94 allows an attacker to cause a Denial of Service (DoS) by uploading a file with a malformed multipart boundary. By appending a large number of characters to the end of the multipart boundary, the server continuously
- 9.1 Critical severity
danswer-ai/danswer: Path Traversal: '..filename'
An arbitrary file overwrite vulnerability exists in the ZulipConnector of danswer-ai/danswer, affecting the latest version. The vulnerability arises from the load_credentials method, where user-controlled input for realm_name and zuliprc_content is used to con
- 7.4 High severity
danswer-ai/danswer: Origin Validation Error
A CORS misconfiguration in danswer-ai/danswer v1.4.1 allows attackers to steal sensitive information such as chat contents, API keys, and other data. This vulnerability occurs due to improper validation of the origin header, enabling malicious web pages to mak
- 7.5 High severity
danswer-ai/danswer: Inefficient Regular Expression Complexity
A vulnerability in danswer-ai/danswer version 1 allows an attacker to perform a Regular Expression Denial of Service (ReDoS) by manipulating regular expressions. This can significantly slow down the application's response time and potentially render it complet
- 8.1 High severity
danswer-ai/danswer: Missing Authorization
An improper access control vulnerability exists in danswer-ai/danswer version v0.3.94. This vulnerability allows the first user created in the system to view, modify, and delete chats created by an Admin. This can lead to unauthorized access to sensitive infor
- 9.8 Critical severity
danswer: Improper Authorization
Danswer is the AI Assistant connected to company's docs, apps, and people. Danswer is vulnerable to unauthorized access to GET/SET of Slack Bot Tokens. Anyone with network access can steal slack bot tokens and set them. This implies full compromise of the cust