CKAN CVE-2025-54384

Requires an authenticated CKAN user with permission to create or edit content rendered through markdown_extract() - specifically dataset, resource, organization, or group descriptions (the advisory cites resource description as the stored-XSS sink), or any extension page reusing that helper. The attacker stores a malicious markdown payload, and a second user must then view the affected page (UI:R), so it is not driveby/unauthenticated against a default config. Exploitation is limited to CKAN versions < 2.10.9 and 2.11.0 through 2.11.3; patched 2.10.9/2.11.4 instances, and portals that disallow untrusted account registration or content submission, are not realistically exposed.

This is a stored cross-site scripting (CWE-79) flaw in CKAN's helpers.markdown_extract(), rated medium (CVSS 6.3) by the vendor via GitHub Security Advisory GHSA-2r4h-8jxv-w2j8. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N) indicates a network-reachable, low-complexity attack that nonetheless requires some privileges (PR:L - an account able to submit dataset/resource/org/group content) and victim interaction (UI:R - a user must load the affected page). No EPSS score, CISA KEV listing, or SSVC decision data was provided, and no public exploit was supplied; therefore this is 'no public exploit identified at time of analysis.' There is no evidence of active exploitation. The two signals that do exist (medium CVSS, confirmed vendor patch) point to a genuine-but-not-urgent issue: it is a real authenticated stored-XSS vector worth patching on exposed/multi-tenant portals, but the PR:L and UI:R requirements materially cap mass-exploitation potential. Note a modeling tension: the vendor scored C:H with S:U, yet stored XSS typically executes in the victim's browser context (arguably a scope change with lower direct confidentiality impact) - treat the C:H as the vendor's conservative choice rather than confirmed evidence of full data disclosure.

An attacker who can register or already holds a content-contributor account on a CKAN portal embeds a malicious markdown/HTML payload in a field rendered via markdown_extract() - such as a resource or dataset description. When another user (including an administrator) browses that dataset, resource, organization, or group page, the unsanitized payload executes in their browser, enabling session/cookie theft or actions on their behalf. No public proof-of-concept was provided, but the patch diff (replacing a regex tag-strip with bleach_clean and adding <script> test cases) confirms the injection path.