Threat Intelligence Database

kotaemon through 0.12.0 contains an insecure deserialization vulnerability in the check_connection endpoint that allows unauthenticated attackers to instantiate arbitrary Python classes by supplying crafted YAML/JSON input with a __type__ field. Attackers can exploit this to override the __type__ field with subprocess.check_output and arbitrary arguments, achieving remote code execution with application process privileges.

CVE-2025-63914 is a medium-severity vulnerability in Cinnamon kotaemon 0.11.0 where the _may_extract_zip function fails to validate the contents of uploaded ZIP files. This allows an attacker with file upload permissions to submit a ZIP bomb, causing excessive resource consumption during decompression and potentially exhausting disk space if extracted data is not cleared. The vulnerability impacts availability but does not affect confidentiality or integrity. Exploitation requires authenticated access but no user interaction beyond upload. The vulnerability could lead to denial of service by making the system unavailable due to resource exhaustion. No known exploits are reported in the wild yet. European organizations using Cinnamon kotaemon, especially those with file upload features exposed internally or externally, should be cautious. Mitigation involves implementing strict ZIP content validation, resource limits during extraction, and ensuring cleanup of extracted files.

MediumVulnerabilityGermanyFranceNetherlands+5#cve#cve-2025-63914

Plaintext password storage in Kotaemon 0.11.0 in the client's localStorage.

HighVulnerabilityGermanyFranceUnited Kingdom+2#cve#cve-2025-56527

Cross site scripting (XSS) vulnerability in Kotaemon 0.11.0 allowing attackers to execute arbitrary code via a crafted PDF.

MediumVulnerabilityGermanyFranceUnited Kingdom+4#cve#cve-2025-56526