CVE-2024-8029: Pribai Privategpt XSS Vulnerability

CVE-2024-8029 Overview

CVE-2024-8029 is a stored Cross-Site Scripting (XSS) vulnerability in imartinez/privategpt version 0.5.0. The flaw resides in the file upload workflow, which accepts Scalable Vector Graphics (SVG) files without sanitizing embedded scripts. Attackers can upload a malicious SVG containing JavaScript, then wait for a victim to click the file link. The browser renders the SVG in the document origin and executes the attacker-controlled script. Successful exploitation enables session hijacking, credential theft, malware delivery, and phishing pivots against other privategpt users. The vulnerability is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Authenticated attackers can execute arbitrary JavaScript in a victim's browser session, leading to account takeover and data exfiltration from the privategpt web interface.

Affected Products

pribai/privategpt version 0.5.0
Deployments exposing the file upload endpoint to untrusted users
Downstream forks that inherit the unsanitized SVG handling logic

Discovery Timeline

2025-03-20 - CVE-2024-8029 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database
Reported through the Huntr Bounty Program

Technical Details for CVE-2024-8029

Vulnerability Analysis

The privategpt application allows users to upload documents that the retrieval-augmented generation (RAG) pipeline ingests. The upload handler in v0.5.0 does not restrict SVG content or strip active elements. SVG is an XML-based image format that supports <script> tags and event handlers such as onload. When the application later serves the uploaded file through a link, the browser treats the response as an image document and executes any embedded JavaScript. Because the script runs in the origin of the privategpt web interface, it can read authenticated session cookies, invoke API endpoints, and manipulate the DOM. Exploitation requires user interaction, specifically a click on the file link, which lowers the barrier for phishing-style pivots inside a trusted workspace.

Root Cause

The root cause is missing output validation and content-type hardening in the file storage and delivery path. The application accepts image/svg+xml uploads and returns them with a renderable content type instead of forcing a download or sanitizing script elements. No Content Security Policy (CSP) restricts inline script execution on served attachments.

Attack Vector

An attacker with upload privileges crafts an SVG file containing a <script> element or an onload handler that executes JavaScript. The attacker uploads the file through the standard privategpt document ingestion interface. The attacker then shares the resulting file URL with a victim or waits for another user to browse to it. When the victim clicks the link, the SVG loads in the browser and the payload executes with the victim's session context. Attackers commonly chain this with document.cookie exfiltration or fetch() requests to the privategpt API to escalate access.

See the Huntr Bounty Report for reproduction details.

Detection Methods for CVE-2024-8029

Indicators of Compromise

Uploaded files with .svg extensions or Content-Type: image/svg+xml in privategpt storage directories
SVG payloads containing <script>, onload=, onerror=, or javascript: URI schemes
Outbound HTTP requests from user browsers to unfamiliar domains immediately after clicking privategpt file links
Unexpected API calls to privategpt endpoints originating from legitimate user sessions

Detection Strategies

Inspect stored uploads for XML elements associated with script execution using YARA or grep rules against the file store
Enable HTTP proxy logging on the privategpt reverse proxy to capture SVG requests and correlate with subsequent anomalous API calls
Instrument the frontend with Content Security Policy reporting to surface inline script execution attempts

Monitoring Recommendations

Alert on new SVG uploads through privategpt and require manual review before public sharing
Monitor authentication logs for session reuse from unexpected IP addresses following file access events
Track browser telemetry for JavaScript errors or document.cookie reads originating from attachment URLs

How to Mitigate CVE-2024-8029

Immediate Actions Required

Disable SVG uploads in privategpt v0.5.0 until a patched release is deployed
Reconfigure the reverse proxy to serve uploaded files with Content-Disposition: attachment to prevent inline rendering
Rotate session tokens and API keys for any user who may have clicked untrusted SVG links
Review the Huntr Bounty Report for reproduction details and validate exposure

Patch Information

No vendor patch is referenced in the NVD entry at the time of publication. Track the imartinez/privategpt repository for a release beyond v0.5.0 that removes SVG rendering or sanitizes uploaded XML content. Until a fix ships, treat all SVG uploads as untrusted and block them at the application or proxy layer.

Workarounds

Add a middleware filter that rejects uploads with image/svg+xml MIME type or .svg extensions
Deploy a strict Content Security Policy that disallows inline scripts on file delivery routes
Serve uploaded files from a separate, sandboxed domain to isolate cookies from the main privategpt origin
Sanitize existing SVG files in storage using a library such as DOMPurify or a server-side XML parser that strips script elements

bash

# Nginx configuration example: force SVG downloads and block inline execution
location /uploads/ {
    if ($request_filename ~* \.svg$) {
        add_header Content-Disposition "attachment";
        add_header Content-Type "application/octet-stream";
    }
    add_header Content-Security-Policy "default-src 'none'; sandbox;";
    add_header X-Content-Type-Options "nosniff";
}