Threat database

kotaemon through 0.12.0 contains an insecure deserialization vulnerability in the check_connection endpoint that allows unauthenticated attackers to instantiate arbitrary Python classes by supplying crafted YAML/JSON input with a __type__ field. Attackers can exploit this to override the __type__ field with subprocess.check_output and arbitrary arguments, achieving remote code execution with application process privileges.

CVE-2025-63914 is a medium-severity vulnerability in Cinnamon kotaemon 0.11.0 where the _may_extract_zip function fails to validate the contents of uploaded ZIP files. This allows an attacker with file upload permissions to submit a ZIP bomb, causing excessive resource consumption during decompression and potentially exhausting disk space if extracted data is not cleared. The vulnerability impacts availability but does not affect confidentiality or integrity. Exploitation requires authenticated access but no user interaction beyond upload. The vulnerability could lead to denial of service by making the system unavailable due to resource exhaustion. No known exploits are reported in the wild yet. European organizations using Cinnamon kotaemon, especially those with file upload features exposed internally or externally, should be cautious. Mitigation involves implementing strict ZIP content validation, resource limits during extraction, and ensuring cleanup of extracted files.

Plaintext password storage in Kotaemon 0.11.0 in the client's localStorage.

Cross site scripting (XSS) vulnerability in Kotaemon 0.11.0 allowing attackers to execute arbitrary code via a crafted PDF.

kotaemon is an open-source RAG-based tool for document comprehension. From versions 0.10.6 and prior, in libs/ktem/ktem/index/file/ui.py, the index_fn method accepts both URLs and local file paths without validation. The pipeline streams these paths directly and stores them, enabling attackers to traverse directories (e.g. ../../../../../.env) and exfiltrate sensitive files. This issue has been patched via commit 37cdc28, in version 0.10.7 which has not been made public at time of publication.