GHSA-9phh-r37v-34wh
lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files
Impact
The browser renders the resulting HTML when opening a direct link to an HTML file via lakeFS. Any JavaScript within that page is executed within the context of the domain lakeFS is running in.
An attacker can inject a malicious script inline, download resources from another domain, or make arbitrary HTTP requests. This would allow the attacker to send information to a random domain or carry out lakeFS operations while impersonating the victim.
Note that to carry out this attack, an attacker must already have access to upload the malicious HTML file to one or more repositories. It also depends on the victim receiving and opening the link to the malicious HTML file.
Patches
This is fixed in lakeFS version 0.106.0
Workarounds
There are no known workarounds at this time.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
What each source reports
GitHub Advisories Score used
lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files
Impact
The browser renders the resulting HTML when opening a direct link to an HTML file via lakeFS. Any JavaScript within that page is executed within the context of the domain lakeFS is running in.
An attacker can inject a malicious script inline, download resources from another domain, or make arbitrary HTTP requests. This would allow the attacker to send information to a random domain or carry out lakeFS operations while impersonating the victim.
Note that to carry out this attack, an attacker must already have access to upload the malicious HTML file to one or more repositories. It also depends on the victim receiving and opening the link to the malicious HTML file.
Patches
This is fixed in lakeFS version 0.106.0
Workarounds
There are no known workarounds at this time.
- Record
GHSA-9phh-r37v-34wh- CVSS 3.1
- 5.8 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N - Updated
- 2026-11-02
OSV
lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files
Impact
The browser renders the resulting HTML when opening a direct link to an HTML file via lakeFS. Any JavaScript within that page is executed within the context of the domain lakeFS is running in.
An attacker can inject a malicious script inline, download resources from another domain, or make arbitrary HTTP requests. This would allow the attacker to send information to a random domain or carry out lakeFS operations while impersonating the victim.
Note that to carry out this attack, an attacker must already have access to upload the malicious HTML file to one or more repositories. It also depends on the victim receiving and opening the link to the malicious HTML file.
Patches
This is fixed in lakeFS version 0.106.0
Workarounds
There are no known workarounds at this time.
- Record
GHSA-9phh-r37v-34wh- CVSS 3.1
- 5.8 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N - Updated
- 2026-11-02
OSVGO-2023-2012No score
lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs
lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs
- Record
GO-2023-2012- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/treeverse/lakefsGo | before 0.106.0 | 0.106.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-9phh-r37v-34wh is a medium vulnerability (CVSS 5.8) in github.com/treeverse/lakefs, published August 14, 2023. No source lists public exploit code. Fixed in github.com/treeverse/lakefs 0.106.0.