CVE-2024-9526
Stored XSS in Kubeflow Pipeline View
There exists a stored XSS Vulnerability in Kubeflow Pipeline View web UI. The Kubeflow Web UI allows to create new pipelines. When creating a new pipeline, it is possible to add a description. The description field allows html tags, which are not filtered properly. Leading to a stored XSS. We recommend upgrading past commit 930c35f1c543998e60e8d648ce93185c9b5dbe8d
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- Passive
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Stored XSS in Kubeflow Pipeline View
There exists a stored XSS Vulnerability in Kubeflow Pipeline View web UI. The Kubeflow Web UI allows to create new pipelines. When creating a new pipeline, it is possible to add a description. The description field allows html tags, which are not filtered properly. Leading to a stored XSS. We recommend upgrading past commit 930c35f1c543998e60e8d648ce93185c9b5dbe8d
- Record
CVE-2024-9526- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/S:P/AU:Y/R:U/V:D/RE:L/U:Green - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2024-50317
There exists a stored XSS Vulnerability in Kubeflow Pipeline View web UI. The Kubeflow Web UI allows to create new pipelines. When creating a new pipeline, it is possible to add a description. The description field allows html tags, which are not filtered properly. Leading to a stored XSS. We recommend upgrading past commit 930c35f1c543998e60e8d648ce93185c9b5dbe8d
- Record
EUVD-2024-50317- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/S:P/AU:Y/R:U/V:D/RE:L/U:Green - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rm25-8wjq-c6qm
There exists a stored XSS Vulnerability in Kubeflow Pipeline View web UI. The Kubeflow Web UI...
There exists a stored XSS Vulnerability in Kubeflow Pipeline View web UI. The Kubeflow Web UI allows to create new pipelines. When creating a new pipeline, it is possible to add a description. The description field allows html tags, which are not filtered properly. Leading to a stored XSS. We recommend upgrading past commit 930c35f1c543998e60e8d648ce93185c9b5dbe8d
- Record
GHSA-rm25-8wjq-c6qm- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:U/V:D/RE:L/U:Green - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
There exists a stored XSS Vulnerability in Kubeflow Pipeline View web UI. The Kubeflow Web UI allows to create new pipelines. When creating a new pipeline, it is possible to add a description. The description field allows html tags, which are not filtered properly. Leading to a stored XSS. We recommend upgrading past commit 930c35f1c543998e60e8d648ce93185c9b5dbe8d
- Record
CVE-2024-9526- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:U/V:D/RE:L/U:Green - CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Stored XSS in Kubeflow Pipeline View
There exists a stored XSS Vulnerability in Kubeflow Pipeline View web UI. The Kubeflow Web UI allows to create new pipelines. When creating a new pipeline, it is possible to add a description. The description field allows html tags, which are not filtered properly. Leading to a stored XSS. We recommend upgrading past commit 930c35f1c543998e60e8d648ce93185c9b5dbe8d
- Record
CVE-2024-9526- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/S:P/AU:Y/R:U/V:D/RE:L/U:Green - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGO-2024-3278 No score
Stored XSS in Kubeflow Pipeline View in github.com/kubeflow/pipelines
Stored XSS in Kubeflow Pipeline View in github.com/kubeflow/pipelines
- Record
GO-2024-3278- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14513-1 No score
govulncheck-vulndb-0.0.20241119T173509-1.1 on GA media
These are all security issues fixed in the govulncheck-vulndb-0.0.20241119T173509-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14513-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/kubeflow/pipelinesGo |
All versions | None known |
govulncheck-vulndbopenSUSE:Tumbleweed From an advisory covering 10 CVEs |
before 0.0.20241119T173509-1.1 | 0.0.20241119T173509-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-9526 is a high vulnerability (CVSS 7.1) in Kubeflow Pipeline View, published November 18, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.22%, the 13th percentile. No source names a fixed version.
References
github.com/kubeflow/pipelines/pull/10315
nvd.nist.gov/vuln/detail/CVE-2024-9526
lists.opensuse.org/archives/list/[email protected]/thread/CJ6SUNDNOZSHM4PZYYGMBH7233D63JOI
Show 10 moreShow less
suse.com/security/cve/CVE-2020-8911