Executive brief
eKuiper is an open-source stream processing engine used to handle data pipelines and IoT integrations. Prior to version 2.4.0, the service allowed authenticated users to register external services with unvalidated names containing malicious HTML and JavaScript. An attacker could craft a service name with embedded script tags that would execute in an administrator's browser when viewing the service list, potentially allowing theft of session credentials or unauthorized actions on the platform.
Technical details
The vulnerability is a stored XSS (CWE-79) in the external service registration endpoints of eKuiper. Prior to v2.4.0, the `/services` POST endpoint failed to enforce alphanumeric validation on service names, allowing crafted payloads such as `<iframe src="javascript:alert(1337)">` to be persisted. When the administrative UI rendered the unescaped service name, the embedded script would execute with the privileges of the authenticated user. The attack requires prior API access (authentication required) and user interaction (administrator viewing the compromised service). Version 2.4.0 and later enforce strict alphanumeric identifier validation via the `validate.ValidateID` function on all service creation and update endpoints, rejecting non-compliant characters.
Affected products
- LF Edge eKuiper < 2.4.0
Timeline
- 2026-09-01: disclosed
- 2026-09-09: advisory
- 2026-09-01: patched: Fix released in v2.4.0