{"action":"Upgrade khoj to 2.0.0-beta.25 or later.","affected":[{"fixed":"2.0.0-beta.25","introduced":"2.0.0-beta.23"}],"component":"khoj","cve_ids":[],"ecosystem":"PyPI","exploited":false,"fixed_versions":["2.0.0-beta.25"],"ghsa_id":"GHSA-62mm-xwmv-crhg","id":"tcs_01M5KF25SMCT7X4EKENCQ4Z590","modified_at":"2026-09-25T23:00:31.263623963Z","published_at":"2026-09-25T21:38:15Z","references":["https://osv.dev/vulnerability/GHSA-62mm-xwmv-crhg","https://github.com/khoj-ai/khoj/security/advisories/GHSA-62mm-xwmv-crhg","https://github.com/khoj-ai/khoj/commit/21c51b9ace4eb59ce79ac0a93b917289824195cf","https://github.com/khoj-ai/khoj/commit/9801ffd2de642772f072ca496032b7c352013b6a","https://github.com/khoj-ai/khoj","https://github.com/khoj-ai/khoj/releases/tag/2.0.0-beta.25"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-62mm-xwmv-crhg","url":"https://osv.dev/vulnerability/GHSA-62mm-xwmv-crhg"}],"summary":"khoj has an unauthenticated path traversal in /home/ endpoint that allows file read from server filesystem"}