Knime Analytics Platform
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Knime Analytics Platform.
By the Year
In 2026 there have been 0 vulnerabilities in Knime Analytics Platform. Knime Analytics Platform did not have any published security vulnerabilities last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 0 | 0.00 |
| 2025 | 0 | 0.00 |
| 2024 | 0 | 0.00 |
| 2023 | 1 | 6.10 |
| 2022 | 2 | 7.40 |
| 2021 | 1 | 4.30 |
It may take a day or so for new Knime Analytics Platform vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Knime Analytics Platform Security Vulnerabilities
KNIME Analytics Platform <5.2.0: XSS via Unsanitized JS view nodes
CVE-2023-5562
6.1 - Medium
- October 12, 2023
An unsafe default configuration in KNIME Analytics Platform before 5.2.0 allows for a cross-site scripting attack. When KNIME Analytics Platform is used as an executor for either KNIME Server or KNIME Business Hub several JavaScript-based view nodes do not sanitize the data that is displayed by default. If the data to be displayed contains JavaScript this code is executed in the browser and can perform any operations that the current user is allowed to perform silently. KNIME Analytics Platform already has configuration options with which sanitization of data can be actived, see https://docs.knime.com/latest/webportal_admin_guide/index.html#html-sanitization-webportal https://docs.knime.com/latest/webportal_admin_guide/index.html#html-sanitization-webportal . However, these are off by default which allows for cross-site scripting attacks. KNIME Analytics Platform 5.2.0 will enable sanitization by default. For all previous releases we recommend users to add the corresponding settings to the executor's knime.ini.
XSS
KNIME Analytics Platform 3.2+ Zip-Slip Directory Traversal Overwrite
CVE-2022-44749
7 - High
- November 24, 2022
A directory traversal vulnerability in the ZIP archive extraction routines of KNIME Analytics Platform 3.2.0 and above can result in arbitrary files being overwritten on the user's system. This vulnerability is also known as 'Zip-Slip'. An attacker can create a KNIME workflow that, when being opened by a user, can overwrite arbitrary files that the user has write access to. It's not necessary to execute the workflow, opening the workflow is sufficient. The user will notice that something is wrong because an error is being reported but only after the files have already been written. This can impact data integrity (file contents are changed) or cause errors in other software (vital files being corrupted). It can even lead to remote code execution if executable files are being replaced and subsequently executed by the user. In all cases the attacker has to know the location of files on the user's system, though.
Directory traversal
In KNIME Analytics Platform below 4.6.0
CVE-2022-31500
7.8 - High
- June 02, 2022
In KNIME Analytics Platform below 4.6.0, the Windows installer sets improper filesystem permissions.
Incorrect Default Permissions
KNIME Analytics Platform before 4.5.0 is vulnerable to XXE (external XML entity injection)
CVE-2021-45096
4.3 - Medium
- December 16, 2021
KNIME Analytics Platform before 4.5.0 is vulnerable to XXE (external XML entity injection) via a crafted workflow file (.knwf), aka AP-17730.
XXE
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Knime Analytics Platform or by Knime? Click the Watch button to subscribe.
