---
title: "CVE-2024-51735: Osmedeus Web Server Vulnerable to Stored XSS, Leading to RCE"
url: https://erroneo.us/security/cve/CVE-2024-51735/
description: "CVE-2024-51735 (github.com/j3ssie/osmedeus (Go)): Osmedeus is a Workflow Engine for Offensive Security. Cross-site Scripting (XSS) occurs on the Osmedues…"
type: vulnerability-record
section: "Security Digest"
date_published: 2024-11-05
date_modified: 2024-11-05
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2024-51735"
kev: false
cvss: 8.7
epss: 0.00458
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2024-51735: Osmedeus Web Server Vulnerable to Stored XSS, Leading to RCE

**Signal:** Normal patch cycle. No exploitation signal; fix it in your next routine update if you are affected. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- No confirmed exploitation. It is not in CISA’s KEV catalog and CISA’s SSVC assessment records no known exploitation. That can change quickly after a public write-up; re-check if you are affected.
- EPSS 0.5% , percentile 39: FIRST’s model estimates a 0.5% chance of exploitation activity in the next 30 days, higher than 39% of all scored CVEs (low). EPSS is a probability, not a verdict.
- Only applies if your dependency tree includes github.com/j3ssie/osmedeus (Go) <= 4.6.4, no fixed version listed . Check your lockfile, including transitive dependencies.

## What it is

Osmedeus is a Workflow Engine for Offensive Security. Cross-site Scripting (XSS) occurs on the Osmedues web server when viewing results from the workflow, allowing commands to be executed on the server. When using a workflow that contains the summary module, it generates reports in HTML and Markdown formats. The default report is based on the general-template.md template.The contents of the files are read and used to generate the report. However, the file contents are not properly filtered, leading to XSS. This may lead to commands executed on the host as well. This issue is not yet resolved. Users are advised to add their own filtering or to reach out to the developer to aid in developing a patch.

## Affected packages

- Go `github.com/j3ssie/osmedeus` <= 4.6.4 → fixed: none listed

## Affected products (CVE record)

- j3ssie osmedeus: <= 4.6.4

## Severity

- GitHub_M CVSS 4.0: 8.7 `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`
- GitHub CVSS 4.0: 9.3 `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N`

## Exploitation

- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation none , automatable yes , technical impact total .
- FIRST EPSS (model of 2026-10-21): 0.46% probability of exploitation activity in the next 30 days; percentile 39.

## Sources

- [GitHub Advisory GHSA-wvv7-wm5v-w2gv](https://github.com/advisories/GHSA-wvv7-wm5v-w2gv)
- [CVE.org record CVE-2024-51735](https://www.cve.org/CVERecord?id=CVE-2024-51735)
- [NVD entry CVE-2024-51735](https://nvd.nist.gov/vuln/detail/CVE-2024-51735)
- [github.com](https://github.com/j3ssie/osmedeus/security/advisories/GHSA-wvv7-wm5v-w2gv)
- [drive.google.com](https://drive.google.com/file/d/1u-YowfzFV1tUqLaZk4s4Y1DykFhJZ8gR/view?usp=sharing)

---
Source page: https://erroneo.us/security/cve/CVE-2024-51735/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt