Live › vulnerability › CVE-2024-58394
Go to dashboardRetool before 3.88.0 has an image proxy endpoint (/api/imageProxy) that serves an attacker-hosted SVG from the Retool origin without a Content Security Policy. An attacker who gets a victim to open the crafted link can run JavaScript in the victim's Retool session.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Self-hosted Retool deployments running a version before are exposed, because the image proxy is reachable without authentication. Managed hosting is not stated in the sources to be affected; teams on a current version can skip it.
3.88.0No product ranges from the sources yet.
3.88.0./api/imageProxy; unknown whether managed Retool cloud needs action.3.88.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Retool before 3.88.0 contains a cross-site scripting vulnerability that allows unauthenticated attackers to execute scripts by proxying malicious SVG files through /api/imageProxy. Attackers can supply an attacker-hosted SVG in the url parameter, which is served from the Retool origin without a Content Security Policy, executing JavaScript in victims' sessions. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-10-15.
This page as .md · .json · in your agent: get_signal("CVE-2024-58394")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.