Conda Forge Github Io
Monthly
Stored/DOM cross-site scripting exists in the conda-forge.org website, where two React components render bot-generated status strings as raw HTML, so a feedstock maintainer who can influence captured autotick-bot output could execute script in the conda-forge.org origin for any visitor who expands the affected entry on the public status or migration pages. The flaw is confirmed in the current main branch (commits 85748ad2368a and prior) and affects a rolling deployment with no tagged releases; at time of analysis there is no vendor-released patch, no confirmed public exploit code, and no CISA KEV listing. The assessed severity is Medium (CVSS 3.1 AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N): the missing sanitization is proven against live production data, but end-to-end weaponization was not demonstrated and reliable delivery of an executing payload into captured build or traceback output is non-trivial.
Stored/DOM cross-site scripting exists in the conda-forge.org website, where two React components render bot-generated status strings as raw HTML, so a feedstock maintainer who can influence captured autotick-bot output could execute script in the conda-forge.org origin for any visitor who expands the affected entry on the public status or migration pages. The flaw is confirmed in the current main branch (commits 85748ad2368a and prior) and affects a rolling deployment with no tagged releases; at time of analysis there is no vendor-released patch, no confirmed public exploit code, and no CISA KEV listing. The assessed severity is Medium (CVSS 3.1 AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N): the missing sanitization is proven against live production data, but end-to-end weaponization was not demonstrated and reliable delivery of an executing payload into captured build or traceback output is non-trivial.