PatchTheCVEquivr vulnerabilities
Recent CVEs affecting quivr products. 4 tracked.
quivr has 4 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 1. Most recent: 2025-03-20. Highest priority: CVE-2024-5885 (score 52/100).
- CVE-2024-6583 MEDIUM 4.3 DOWNGRADE A path traversal vulnerability exists in the latest version of stangirard/quivr
- CVE-2024-6229 MEDIUM 5.4 UPGRADE A stored cross-site scripting (XSS) vulnerability exists in the 'Upload Knowledge' feature of stangirard/quivr
- CVE-2024-5885 HIGH 8.6 DOWNGRADE stangirard/quivr version 0.0.236 contains a Server-Side Request Forgery (SSRF) vulnerability
- CVE-2024-4851 HIGH 7.7 DOWNGRADE A Server-Side Request Forgery (SSRF) vulnerability exists in the stangirard/quivr application, version 0.0.204
FAQ
How do I fix quivr vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is quivr being exploited right now?
None of the tracked quivr CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which quivr CVE should I patch first?
CVE-2024-5885 currently ranks highest (52/100): stangirard/quivr version 0.0.236 contains a Server-Side Request Forgery (SSRF) vulnerability.