CVE-2024-41177

CVE-2024-41177: Apache Zeppelin: XSS in the Helium module

Vendor Apache Software Foundation

Product Apache Zeppelin

Weakness CWE-79 · XSS

Published August 3, 2025

Last update November 4, 2025

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Incomplete Blacklist to Cross-Site Scripting vulnerability in Apache Zeppelin. This issue affects Apache Zeppelin: before 0.12.0. Users are recommended to upgrade to version 0.12.0, which fixes the issue.

Key dates

02Disclosure timeline

August 3, 2025 CVE published

November 4, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-41177 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html AskarLabs — CWE-79 write-up Cross-Site Scripting

Related vulnerabilities

04Related CVE

CVE-2026-66471 WordPress Accordion plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerability CVE-2026-66687 WordPress WpBookingly plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerability CVE-2026-2357 Bold Page Builder <= 5.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2026-73357 WordPress GiveWP plugin < 4.16.6 - Cross Site Scripting (XSS) vulnerability CVE-2026-73360 WordPress Chaty Pro plugin <= 3.5.8 - Cross Site Scripting (XSS) vulnerability