CVE-2025-56526: Cinnamon Kotaemon XSS Vulnerability

CVE-2025-56526 Overview

CVE-2025-56526 is a stored cross-site scripting (XSS) vulnerability in Cinnamon Kotaemon version 0.11.0, an open-source retrieval-augmented generation (RAG) framework. The flaw stems from unsanitized rendering of PDF content within the application's user interface. Attackers can craft a malicious PDF containing embedded scripts. When a user uploads or previews the crafted document, the injected code executes in the victim's browser context. The vulnerability is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Successful exploitation enables session hijacking, exfiltration of credentials stored in localStorage, and unauthorized actions performed under the victim's authenticated session in the Kotaemon web application.

Affected Products

Cinnamon Kotaemon 0.11.0
Kotaemon deployments using the vulnerable PDF preview component
RAG pipelines built on unpatched Kotaemon versions

Discovery Timeline

2025-11-18 - CVE-2025-56526 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-56526

Vulnerability Analysis

Kotaemon renders parsed PDF content directly into the web interface without sanitizing HTML or JavaScript payloads embedded in document text or metadata. A crafted PDF containing <script> tags or event-handler attributes is stored server-side and delivered to any user who views the document. Because the payload persists across sessions and users, this is a stored XSS rather than reflected. Public disclosure notes accompanying the CVE also describe plaintext credential exposure in browser localStorage, which amplifies the impact when combined with script execution.

Root Cause

The root cause is missing output encoding and HTML sanitization in the PDF content rendering path. Extracted document text is inserted into the DOM without escaping HTML-significant characters or applying an allowlist-based sanitizer such as DOMPurify. Any markup embedded in the source PDF is therefore parsed and executed by the browser as active content.

Attack Vector

An attacker prepares a PDF containing JavaScript payloads within text streams, annotations, or form fields. The attacker uploads the file to a Kotaemon instance, or delivers it to a user with upload privileges. When another authenticated user opens the document through the Kotaemon UI, the script runs under that user's origin. The exploit requires user interaction (opening the document) but no privileges on the target instance. Public disclosure references are available in the Kotaemon CVE-2025-56526/56527 disclosure repository and the Notion stored XSS analysis.

No verified exploit code is published in the NVD references. The vulnerability mechanism can be reproduced by embedding standard XSS payloads such as <img src=x onerror=...> into PDF text objects and uploading the file to a vulnerable instance.

Detection Methods for CVE-2025-56526

Indicators of Compromise

Uploaded PDF files whose extracted text contains HTML tags such as <script>, <iframe>, <img onerror=...>, or javascript: URIs
Outbound browser requests from Kotaemon user sessions to unfamiliar domains shortly after opening a document
Unexpected reads or writes to localStorage keys holding API tokens or credentials
New or modified documents in the Kotaemon file index that were uploaded by low-privilege or unauthenticated accounts

Detection Strategies

Scan PDF uploads server-side for embedded HTML or JavaScript markup before indexing
Apply a Content Security Policy (CSP) in report-only mode and alert on script-src violations originating from document preview routes
Review web server access logs for repeated uploads followed by document-view requests from the same or related sessions
Correlate browser telemetry with document open events to identify script execution originating from PDF preview components

Monitoring Recommendations

Log all file uploads with hash, uploader identity, and MIME type for retrospective analysis
Monitor authentication events for session anomalies such as impossible-travel or credential reuse from new IPs after document access
Track modifications to browser storage from Kotaemon origins using endpoint browser telemetry where available

How to Mitigate CVE-2025-56526

Immediate Actions Required

Upgrade Kotaemon to a version later than 0.11.0 that includes the sanitization fix from the upstream repository
Restrict PDF upload permissions to trusted, authenticated users until the patch is applied
Rotate any API keys, session tokens, or credentials stored in browser localStorage for Kotaemon origins
Review the document index and remove PDFs from untrusted sources

Patch Information

Remediation is tracked in the upstream Cinnamon/kotaemon repository, with related hardening in commit 37cdc28. Administrators should track the project's release notes and apply the version that explicitly addresses CVE-2025-56526 by sanitizing PDF-derived content before DOM insertion.

Workarounds

Deploy a strict Content Security Policy that disallows inline scripts and restricts script-src to trusted origins
Place Kotaemon behind a reverse proxy that strips or rewrites active content in served HTML
Disable in-browser PDF preview and force PDFs to download for local viewing outside the application origin
Move credentials out of localStorage into HttpOnly cookies to reduce the impact of successful script execution

bash

# Example Content Security Policy header for a reverse proxy fronting Kotaemon
add_header Content-Security-Policy "default-src 'self'; \
  script-src 'self'; \
  object-src 'none'; \
  frame-ancestors 'none'; \
  base-uri 'self'; \
  require-trusted-types-for 'script';" always;