Vulnerabilidades de Cheshire-cat-ai
CVEs publicadas que afetam produtos de Cheshire-cat-ai: 3 registro(s), com severidade, exploração e correções.
CVE-2026-108725
Média · 5.4
CWE-79 11/10/2026
Cheshire Cat AI core through 2.0.23 Stored XSS via uploads plugin
Cheshire Cat AI core through 2.0.23 contains a stored cross-site scripting vulnerability in the uploads plugin that allows authenticated users to upload HTML files via POST /uploads without type restrictions. Attackers can send the public GET /uploads/{path} URL to a signed-in victim, executing script in the application origin with the victim's access_token cookie, including administrators.
CVE-2026-90579
Alta · 7.3
CWE-287 13/09/2026
cheshire-cat-ai Cheshire Cat AI custom_auth_handler.py _authorize_http_key missing authentication
A vulnerability has been found in cheshire-cat-ai Cheshire Cat AI up to 1.9.2. This affects the function _authorize_http_key of the file core/cat/factory/custom_auth_handler.py. The manipulation of the argument user_id leads to missing authentication. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2026-85093
Média · 6.5
CWE-863 03/09/2026
Cheshire Cat AI Memory Collection Endpoint Information Disclosure
Cheshire Cat AI's GET /memory/collections/{collection_id}/points endpoint fails to apply per-user filtering when retrieving episodic memory points. Authenticated attackers with MEMORY:READ permission can retrieve all users' stored conversation messages and personal data by paginating through the collection using the offset cursor.