CVE-2024-52290 Stored XSS in Configuration Key Functionality
An attacker with modification rights can inject XSS payloads into configuration keys, allowing code execution in the browser of users who delete those keys.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-52290?
CVE-2024-52290 is a medium-severity cross-site scripting vulnerability in lf-edge ekuiper, published on 14 May 2025. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
LF Edge eKuiper is a lightweight internet of things (IoT) data analytics and stream processing engine. Prior to version 2.1.0 user with rights to modificate the service (e.g. kuiperUser role) can inject a cross-site scripting payload into Connection Configuration key `Name` (`confKey`) parameter. After this setup, when any user with access to this service (e.g. admin) tries to delete this key, a payload acts in the victim's browser. Version 2.1.0 fixes the issue.
Weakness: CWE-79
Which versions are affected by CVE-2024-52290?
6 open source packages ship an affected version, including github.com/lf-edge/ekuiper and github.com/lf-edge/ekuiper/v2. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/lf-edge/ekuiper Go | All versions | None |
github.com/lf-edge/ekuiper Go | All versions to 1.14.7 | None |
github.com/lf-edge/ekuiper Go | All versions to 1.14.7 | None |
github.com/lf-edge/ekuiper/v2 Go | All versions | 2.1.0 |
github.com/lf-edge/ekuiper/v2 Go | All versions | 2.1.0 |
github.com/lf-edge/ekuiper/v2 Go | All versions | 2.1.0 |
Products include Lfedge Ekuiper.
How do I fix CVE-2024-52290?
Upgrade to a fixed version.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-52290 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-52290 exists.
Other vulnerabilities in lf-edge ekuiper
Sources
Also known as GHSA-9cwv-pxcr-hfjc, GO-2025-3682.