CVE-2025-24978

LF Edge eKuiper: Self-XSS in External Service Creation

Published

2026-09-09

Modified

2026-09-09

Aliases

GHSA-g8rh-fjm6-h2h9

Sources

github-advisory

Summary

### Summary A Cross-Site Scripting (XSS) vulnerability in external service creation allows an authenticated attacker to inject HTML/script payloads into external service names, which may execute in a user's browser when rendered by administrative web interfaces. ### Details Prior to v2.4.0, external service registration endpoints did not strictly enforce alphanumeric character restrictions on service names. An operator or attacker with API access could register a service using a crafted name containing HTML elements (such as ` `). If an administrative web UI rendered the unescaped service name, arbitrary script execution could occur in the context of the user's browser session. ### PoC 1. Create an external service JSON definition with a filename containing an XSS payload, e.g. ` .json` inside a ZIP archive. 2. In external service creation, upload the ZIP and provide the matching service name: ` `. 3. Upon service registration, the unescaped name executes when rendered in the UI context. ### Impact Self-XSS / Stored XSS leading to potential session token leakage or unauthorized actions in the context of the affected user's browser session. ### Remediation & Patches - **Upgrade to eKuiper >= 2.4.0**: Strict alphanumeric identifier validation (`validate.ValidateID`) is now enforced on all external service creation and update endpoints, rejecting invalid characters. ### Workarounds - Protect eKuiper management endpoints (`POST /services`) with authentication and network-level firewalls. ### Credits - Reported by Alexey Kosmachev, Bi.Zone (@TheMostKnown)

Affected packages

Remediation: Upgrade to 2.4.0 or later.

References

• https://github.com/advisories/GHSA-g8rh-fjm6-h2h9