CVE-2024-48141

CVSS 7.5 HIGHEPSS 0.4%CWE-77

Vexday Risk Score

21Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 7.5EPSS 0.4%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

24 Oct 2024Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

A prompt injection vulnerability in the chatbox of Zhipu AI CodeGeeX v2.17.0 allows attackers to access and exfiltrate all previous and subsequent chat data between the user and the AI assistant via a crafted message.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

n/a · n/a

References

https://github.com/soursec/CVEs/tree/main/CVE-2024-48141 https://marketplace.visualstudio.com/items?itemName=aminer.codegeex