CVE-2025-24978

Name of the Vulnerable Software and Affected Versions eKuiper versions prior to 2.4.0

Description A Cross-Site Scripting (XSS) issue exists in the external service creation process. Authenticated attackers can inject HTML or script payloads into external service names because the registration endpoints did not strictly enforce alphanumeric character restrictions. If an administrative web interface renders these unescaped names, arbitrary scripts can execute in the user's browser session, potentially leading to session token leakage or unauthorized actions. This occurs when a crafted name, such as one containing an <iframe> element, is provided during service registration.

Recommendations Upgrade to eKuiper version 2.4.0 or later. Protect management endpoints, specifically POST /services, using authentication and network-level firewalls.