Vulnerability record · CVE-2024-5062 · published 30 June 2024

CVE-2024-5062: Zenml cross-site scripting vulnerability

Zenml · Zenml

A reflected Cross-Site Scripting (XSS) vulnerability was identified in zenml-io/zenml version 0.57.1. The vulnerability exists due to improper neutralization of input during web page generation, specifically within the survey redirect parameter. This flaw allows an attacker to redirect users to a specified URL after completing a survey, without proper validation of the 'redirect' parameter. Consequently, an attacker can execute arbitrary JavaScript code in the context of the user's browser session. This vulnerability could be exploited to steal cookies, potentially leading to account takeover.

6.1 CVSS 3.1 Medium EPSS 0.39% · top 69.4% CWE-79 · Cross-site scripting

6.1CVSS 3.1 base score

0.39%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

4References, 2 tagged exploit

17 Jun 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Zenml Zenml

References

Link	Tags
https://github.com/zenml-io/zenml/commit/21edd863c0ba53c1110b6f018a07c2d6853cf6d4	Patch
https://huntr.com/bounties/ceddd3c1-a9da-4d6c-85c4-41d4d1e1102f	Exploit
https://github.com/zenml-io/zenml/commit/21edd863c0ba53c1110b6f018a07c2d6853cf6d4	Patch
https://huntr.com/bounties/ceddd3c1-a9da-4d6c-85c4-41d4d1e1102f	Exploit

Track CVE-2024-5062 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.9CVE-2024-2083Zenml vulnerabilityA directory traversal vulnerability exists in the zenml-io/zenml repository, specifically within the /api/v1/steps endpoint. Attackers can exploit th…EPSS 37%16 Apr 2024 8.8CVE-2024-4680Zenml insufficient session expiration vulnerabilityA vulnerability in zenml-io/zenml version 0.56.3 allows attackers to reuse old session credentials or session IDs due to insufficient session expirat…EPSS 0.41%8 Jun 2024 8.8CVE-2024-28424Zenml code injection vulnerabilityzenml v0.55.4 was discovered to contain an arbitrary file upload vulnerability in the load function at /materializers/cloudpickle_materializer.py. Th…EPSS 0.71%14 Mar 2024 8.8CVE-2024-25723ZenML Server activate endpoint allows remote privilege escalationZenML Server before 0.46.7 exposes the /api/v1/users/{user_name_or_id}/activate REST endpoint, which grants access based on a valid username plus a n…EPSS 71%analysed27 Feb 2024 7.8CVE-2025-8406Zenml path traversal vulnerabilityZenML version 0.83.1 is affected by a path traversal vulnerability in the `PathMaterializer` class. The `load` function uses `is_path_within_director…EPSS 0.37%5 Oct 2025 7.5CVE-2024-9340Zenml vulnerabilityA Denial of Service (DoS) vulnerability in zenml-io/zenml version 0.66.0 allows unauthenticated attackers to cause excessive resource consumption by …EPSS 0.95%20 Mar 2025 6.5CVE-2024-2035Zenml missing authorization vulnerabilityAn improper authorization vulnerability exists in the zenml-io/zenml repository, specifically within the API PUT /api/v1/users/id endpoint. This vuln…EPSS 0.63%6 Jun 2024 6.1CVE-2024-2383Zenml clickjacking vulnerabilityA clickjacking vulnerability exists in zenml-io/zenml versions up to and including 0.55.5 due to the application's failure to set appropriate X-Frame…EPSS 0.36%6 Jun 2024

Source: NIST National Vulnerability Database (record CVE-2024-5062), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.