# CVE-2025-24978: LF Edge eKuiper stored XSS in external service creation

Source: https://junglewise.ai/threats/cve-2025-24978-lf-edge-ekuiper-stored-xss-in-external-service-creation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-09. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-24978 · Severity: low · CVSS 3.7 · Published 2026-09-09

eKuiper is an open-source stream processing engine used to handle data pipelines and IoT integrations. Prior to version 2.4.0, the service allowed authenticated users to register external services with unvalidated names containing malicious HTML and JavaScript. An attacker could craft a service name with embedded script tags that would execute in an administrator's browser when viewing the service list, potentially allowing theft of session credentials or unauthorized actions on the platform.

Technologies: [github.com/lf-edge/ekuiper (Go)](https://junglewise.ai/threats/technologies/github-com-lf-edge-ekuiper), [github.com/lf-edge/ekuiper/v2 (Go)](https://junglewise.ai/threats/technologies/github-com-lf-edge-ekuiper-v2), [LF Edge eKuiper](https://junglewise.ai/threats/technologies/ekuiper). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [LF Edge](https://junglewise.ai/threats/vendors/lf-edge).

## Quick answers

**Is CVE-2025-24978 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-24978 being exploited in the wild.

**How severe is CVE-2025-24978?** Low severity, with a CVSS score of 3.7, published 9 September 2026.

**Which products and versions are affected?** github.com/lf-edge/ekuiper (Go) SEMVER:introduced=0; github.com/lf-edge/ekuiper/v2 (Go) < 2.4.0, SEMVER:introduced=0,fixed=2.4.0; LF Edge eKuiper < 2.4.0.

**Is there a fix for CVE-2025-24978?** Yes. github.com/lf-edge/ekuiper/v2 (Go): upgrade to 2.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-24978 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-24978?** Check whether you run github.com/lf-edge/ekuiper (Go), github.com/lf-edge/ekuiper/v2 (Go) or LF Edge eKuiper at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/lf-edge/ekuiper/v2 (Go): upgrade to 2.4.0 or later

  ```sh
  go get github.com/lf-edge/ekuiper/v2@v2.4.0
  ```


## Technical details

The vulnerability is a stored XSS (CWE-79) in the external service registration endpoints of eKuiper. Prior to v2.4.0, the `/services` POST endpoint failed to enforce alphanumeric validation on service names, allowing crafted payloads such as `&lt;iframe src="javascript:alert(1337)"&gt;` to be persisted. When the administrative UI rendered the unescaped service name, the embedded script would execute with the privileges of the authenticated user. The attack requires prior API access (authentication required) and user interaction (administrator viewing the compromised service). Version 2.4.0 and later enforce strict alphanumeric identifier validation via the `validate.ValidateID` function on all service creation and update endpoints, rejecting non-compliant characters.

## Affected products

- LF Edge eKuiper < 2.4.0

## Identifiers

- CVE-2025-24978
- GHSA-g8rh-fjm6-h2h9
- GO-2026-6446

## Timeline

- 2026-09-01: disclosed
- 2026-09-09: advisory
- 2026-09-01: patched: Fix released in v2.4.0

## References

- [https://api.github.com/users/TheMostKnown](https://api.github.com/users/TheMostKnown)
- [https://github.com/TheMostKnown](https://github.com/TheMostKnown)
- [https://api.github.com/users/TheMostKnown/gists%7B/gist_id%7D](https://api.github.com/users/TheMostKnown/gists%7B/gist_id%7D)
- [https://api.github.com/users/TheMostKnown/repos](https://api.github.com/users/TheMostKnown/repos)
- [https://avatars.githubusercontent.com/u/65551462?v=4](https://avatars.githubusercontent.com/u/65551462?v=4)
- [https://api.github.com/users/TheMostKnown/events%7B/privacy%7D](https://api.github.com/users/TheMostKnown/events%7B/privacy%7D)

## Related threats

- [LF Edge eKuiper path traversal in plugin installation](https://junglewise.ai/threats/cve-2025-58363-lf-edge-ekuiper-path-traversal-in-plugin-installation)
- [LF Edge eKuiper SSRF in external service registration](https://junglewise.ai/threats/cve-2025-24979-lf-edge-ekuiper-ssrf-in-external-service-registration)
- [GO-2025-4158 - LF Edge eKuiper is vulnerable to Arbitrary File Read/Write via unsanitized names and zip extraction in…](https://junglewise.ai/threats/go-2025-4158-lf-edge-ekuiper-is-vulnerable-to-arbitrary-file-read-write-89ee8418)
- [LF Edge eKuiper is vulnerable to Arbitrary File Read/Write via unsanitized names and zip extraction](https://junglewise.ai/threats/lf-edge-ekuiper-is-vulnerable-to-arbitrary-file-read-write-via-6fdf2ea9)
- [GO-2025-3827 - eKuiper API endpoints handling SQL queries with user-controlled table names. in github.com/lf-edge/ekuiper](https://junglewise.ai/threats/cve-2025-54379-pysec-2025-241-lf-edge-ekuiper-is-a-lightweight-iot-data)