khoj vulnerabilities

2 known vulnerabilities in khoj from Khoj-ai. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.1 High severity

  khoj: Authorization Bypass Through User-Controlled Key

  CVE-2025-69207Feb 2, 2026Khoj-ai

  Khoj is a self-hostable artificial intelligence app. Prior to 2.0.0-beta.23, an IDOR in the Notion OAuth callback allows an attacker to hijack any user's Notion integration by manipulating the state parameter. The callback endpoint accepts any user UUID withou

• 7.5 High severity

  khoj: Improper Neutralization of Special Elements used in a Command

  CVE-2024-25639Jul 8, 2024Khoj-ai

  Khoj is an application that creates personal AI agents. The Khoj Obsidian, Desktop and Web clients inadequately sanitize the AI model's response and user inputs. This can trigger Cross Site Scripting (XSS) via Prompt Injection from untrusted documents either i