Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

khoj-ai/khoj

              master @ 3c3d8ee
            

Fixes

CVEs

HIGH

Peak severity

28.6%

Coverage

Highlights

Auth Bypass: 7 prior fixes. Scrutinize any change in this area.

src/khoj/routers/auth.py: most-fixed (6 issues). Treat as high-risk during review.

11 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Incomplete email verification checks and weak authentication logic in the magic link mechanism allowed attackers to authenticate with only a verification code. Ensuring both email and code validation are strictly coupled prevents this hijack vector.

Auth Bypass: A lack of validation on the OAuth state parameter during the Notion callback flow allowed session hijacking and insecure direct object reference (IDOR), mapped to CVE-2025-69207.

Stored XSS: Unsanitized chat references and markdown payloads allowed injection of arbitrary HTML and Javascript into the web, desktop, and Obsidian interfaces. Mitigations require consistent DOMPurify validation and output encoding instead of using unsafe raw innerHTML.