CVE-2024-52959

9.3 criticalEPSS 0.6%

Critical (9.3) in gss iota c.ai. EPSS 0.6% chance of exploitation in the next 30 days.

A Improper Control of Generation of Code ('Code Injection') vulnerability in plugin management in iota C.ai Conversational Platform from 1.0.0 through 2.1.3 allows remote authenticated users to perform arbitrary system commands via a DLL file.

Severity

CVSS 4.0

9.3 critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:H

CVSS 3.1

7.2 high

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 46% of CVEs (scores of 2026-10-31)
CWE: CWE-94
Published: 2024-11-27
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

gss:iota_c.ai

References

https://zuso.ai/advisory/za-2024-12

Check your stack JSON