CVE-2025-24978 — ekuiper
LOWCVE-2025-24978 is a low-severity (CVSS 3.7) vulnerability in github.com/lf-edge/ekuiper/v2. A fix is available for github.com/lf-edge/ekuiper/v2 — see the affected versions and patch details below.
LF Edge eKuiper: Self-XSS in External Service Creation
Real-World Exposure
github.com/lf-edge/ekuiper/v2Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.
Description
Summary
A Cross-Site Scripting (XSS) vulnerability in external service creation allows an authenticated attacker to inject HTML/script payloads into external service names, which may execute in a user's browser when rendered by administrative web interfaces.
Details
Prior to v2.4.0, external service registration endpoints did not strictly enforce alphanumeric character restrictions on service names. An operator or attacker with API access could register a service using a crafted name containing HTML elements (such as <iframe src="...">). If an administrative web UI rendered the unescaped service name, arbitrary script execution could occur in the context of the user's browser session.
PoC
- Create an external service JSON definition with a filename containing an XSS payload, e.g.
<iframe src="javascript:alert1337">.jsoninside a ZIP archive. - In external service creation, upload the ZIP and provide the matching service name:
<iframe src="javascript:alert1337">. - Upon service registration, the unescaped name executes when rendered in the UI context.
Impact
Self-XSS / Stored XSS leading to potential session token leakage or unauthorized actions in the context of the affected user's browser session.
Remediation & Patches
- Upgrade to eKuiper >= 2.4.0: Strict alphanumeric identifier validation (
validate.ValidateID) is now enforced on all external service creation and update endpoints, rejecting invalid characters.
Workarounds
- Protect eKuiper management endpoints (
POST /services) with authentication and network-level firewalls.
Credits
- Reported by Alexey Kosmachev, Bi.Zone (@TheMostKnown)
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐹Go | github.com/lf-edge/ekuiper/v2 | all versions | 2.4.0go get github.com/lf-edge/ekuiper/v2@v2.4.0 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/lf-edge/ekuiper/v2, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update github.com/lf-edge/ekuiper/v2 to 2.4.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2025-24978 is resolved across your whole dependency graph.
Workarounds
Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page.
Frequently Asked Questions
Is CVE-2025-24978 in your dependencies?
Find it across Go, including transitive dependencies.