PyPI/khoj: high

khoj has an unauthenticated path traversal in /home/ endpoint that allows file read from server filesystem

Action: Upgrade khoj to 2.0.0-beta.25 or later.

pip install khoj==2.0.0-beta.25

Affected

Fixed versions

Sources

• osv: GHSA-62mm-xwmv-crhg
• https://github.com/khoj-ai/khoj/security/advisories/GHSA-62mm-xwmv-crhg
• https://github.com/khoj-ai/khoj/commit/21c51b9ace4eb59ce79ac0a93b917289824195cf
• https://github.com/khoj-ai/khoj/commit/9801ffd2de642772f072ca496032b7c352013b6a
• https://github.com/khoj-ai/khoj
• https://github.com/khoj-ai/khoj/releases/tag/2.0.0-beta.25

published 2026-09-25T21:38:15Z · modified 2026-09-25T23:00:31.263623963Z · JSON