PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-13508 khoj-ai CVE debrief

CVE-2026-13508 is a low-severity vulnerability in khoj-ai khoj up to 2.0.0-beta.28. The flaw is located in the Conversation Sharing Handler, specifically in the src/khoj/routers/api_chat.py file. An attacker can manipulate the conversation.agent argument to cause incorrect authorization. Remote exploitation of this vulnerability is possible. The exploit has been published and may be used. A pull request to fix this issue has been submitted and awaits acceptance.

Vendor
khoj-ai
Product
khoj
CVSS
LOW 2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-28
Original CVE updated
2026-06-28
Advisory published
2026-06-28
Advisory updated
2026-06-28

Who should care

Defenders of khoj-ai khoj installations up to 2.0.0-beta.28 should prioritize patching this vulnerability. Security teams responsible for managing dependencies and third-party libraries should also be aware of this issue. Additionally, developers using khoj-ai khoj in their projects should review their exposure and apply the fix as soon as possible.

Technical summary

The vulnerability is caused by a flaw in the Conversation Sharing Handler of khoj-ai khoj up to 2.0.0-beta.28. The issue is located in the src/khoj/routers/api_chat.py file. An attacker can exploit this vulnerability by manipulating the conversation.agent argument, leading to incorrect authorization. The CVSS score for this vulnerability is 2, indicating a low severity. The CVSS vector is CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.

Defensive priority

This vulnerability has a low CVSS score of 2, indicating a relatively low severity. However, defenders should still prioritize patching this vulnerability to prevent potential exploitation.

Recommended defensive actions

  • Apply the patch from the pull request submitted by the vendor.
  • Review and update dependencies to ensure khoj-ai khoj is not used in a vulnerable version.
  • Implement additional monitoring and logging to detect potential exploitation attempts.
  • Consider compensating controls, such as Web Application Firewalls (WAFs), to help mitigate potential attacks.
  • Verify that the fix does not introduce new vulnerabilities or functionality issues.

Evidence notes

The CVE record and NVD detail provide information about the vulnerability. The source item URL provides additional context from the vendor. The references from Vuldb and GitHub offer further details about the issue and the proposed fix.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-13508 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-13508

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-13508 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-13508

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.