EUVD-2026-54717Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Write access to commit payload requires authentication (PR:L); victim must browse to trigger rendering (UI:R); injected script runs in victim's authenticated session causing scope change (S:C) with full session-level confidentiality and integrity impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
lakeFS is an open-source tool that transforms object storage into a Git-like repositories. Prior to version 1.81.1 of the open source edition and 1.84.0 of the enterprise edition, lakeFS Web UI renders markdown files from repository objects without sanitizing the resulting HTML. A user with write access to any repository branch can commit a .md object containing arbitrary HTML/JavaScript. Any other user who opens that object, or who navigates to a repository or directory containing a malicious README.md, executes the attacker-supplied script in their own authenticated session. lakeFS fixes the issue in v1.81.1 and lakeFS Enterprise fixes the issue in in v1.84.0. Enterprise customers using older versions can temporarily disable Markdown rendering by adding YAML to their config. No workaround exists for OSS release. Users are advised to upgrade to the latest version for both lakeFS and lakeFS-Enterprise.
AnalysisAI
Stored cross-site scripting in lakeFS Web UI allows an authenticated contributor to execute arbitrary JavaScript in any other user's authenticated browser session. The renderer for .md objects and README.md files in both the open-source edition (< 1.81.1) and Enterprise edition (< 1.84.0) passes Markdown-derived HTML to the DOM without sanitization, making any writable branch a potential injection point. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and automatic rendering of README.md on directory browse materially lower the barrier to exploitation for any insider or contributor with write access.
Technical ContextAI
lakeFS, developed by Treeverse, wraps object storage systems (S3, GCS, Azure Blob) with Git-like branching semantics and exposes a React-based Web UI for browsing repository objects. The vulnerable component, useMarkdownProcessor.tsx (located at webui/src/pages/repositories/repository/fileRenderers/useMarkdownProcessor.tsx, identified in the referenced commit 77539527e987fb05), processes .md files and README.md entries for inline rendering. Standard Markdown parsers allow raw HTML passthrough by default; without an explicit sanitization step - such as DOMPurify - attacker-controlled markup containing <script> tags or event-handler attributes is injected directly into the DOM. CWE-79 (Improper Neutralization of Input During Web Page Generation) is the root cause class. Both the open-source (cpe:2.3:a:treeverse:lakefs:*) and enterprise (cpe:2.3:a:treeverse:lakefs-enterprise:*) editions share this UI codebase and are equally affected. The CVSS Scope:Changed (S:C) metric reflects that injected script executes in the victim's authenticated browser context, outside the trust boundary of the originating object.
RemediationAI
The primary fix is upgrading lakeFS OSS to v1.81.1 or later and lakeFS Enterprise to v1.84.0 or later, as documented in the vendor's GitHub Security Advisory at https://github.com/treeverse/lakeFS/security/advisories/GHSA-c2r5-5j4w-2xff. For Enterprise customers unable to upgrade immediately, the vendor provides a temporary compensating control: add YAML configuration to disable Markdown rendering in the Web UI entirely, which eliminates the attack surface at the cost of losing Markdown preview functionality for all users. No equivalent workaround is available for the open-source release - OSS users must upgrade. Following remediation, security teams should audit existing repository objects for suspicious .md files (particularly any README.md committed by unexpected contributors) across all branches accessible to privileged users, as previously committed payloads remain in repository history.
Unauthenticated attackers can overwrite operator metadata including email and company name in lakeFS versions through 1.
lakeFS is an open-source tool that transforms object storage into a Git-like repositories. LakeFS's S3 gateway does not
Authenticated users in lakeFS prior to version 1.77.0 can exploit path traversal vulnerabilities in the local block adap
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today