Lakefs
Monthly
Stored cross-site scripting in lakeFS Web UI allows an authenticated contributor to execute arbitrary JavaScript in any other user's authenticated browser session. The renderer for `.md` objects and `README.md` files in both the open-source edition (< 1.81.1) and Enterprise edition (< 1.84.0) passes Markdown-derived HTML to the DOM without sanitization, making any writable branch a potential injection point. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and automatic rendering of `README.md` on directory browse materially lower the barrier to exploitation for any insider or contributor with write access.
Authenticated users in lakeFS prior to version 1.77.0 can exploit path traversal vulnerabilities in the local block adapter to read and write files outside their intended storage boundaries by bypassing insufficient prefix validation checks. An attacker with valid credentials can manipulate object identifiers and path sequences to access sibling directories and storage namespaces they should not have access to. A patch is available in version 1.77.0 and later.
Unauthenticated attackers can overwrite operator metadata including email and company name in lakeFS versions through 1.83.0 via the /setup_comm_prefs endpoint, potentially disabling security communications and manipulating telemetry. Exploit code is publicly available, but no active exploitation has been confirmed by CISA KEV.
lakeFS is an open-source tool that transforms object storage into a Git-like repositories. LakeFS's S3 gateway does not validate timestamps in authenticated requests, allowing replay attacks. [CVSS 6.5 MEDIUM]
Stored cross-site scripting in lakeFS Web UI allows an authenticated contributor to execute arbitrary JavaScript in any other user's authenticated browser session. The renderer for `.md` objects and `README.md` files in both the open-source edition (< 1.81.1) and Enterprise edition (< 1.84.0) passes Markdown-derived HTML to the DOM without sanitization, making any writable branch a potential injection point. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and automatic rendering of `README.md` on directory browse materially lower the barrier to exploitation for any insider or contributor with write access.
Authenticated users in lakeFS prior to version 1.77.0 can exploit path traversal vulnerabilities in the local block adapter to read and write files outside their intended storage boundaries by bypassing insufficient prefix validation checks. An attacker with valid credentials can manipulate object identifiers and path sequences to access sibling directories and storage namespaces they should not have access to. A patch is available in version 1.77.0 and later.
Unauthenticated attackers can overwrite operator metadata including email and company name in lakeFS versions through 1.83.0 via the /setup_comm_prefs endpoint, potentially disabling security communications and manipulating telemetry. Exploit code is publicly available, but no active exploitation has been confirmed by CISA KEV.
lakeFS is an open-source tool that transforms object storage into a Git-like repositories. LakeFS's S3 gateway does not validate timestamps in authenticated requests, allowing replay attacks. [CVSS 6.5 MEDIUM]