CVE-2026-48026: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in treeverse lakeFS
lakeFS is an open-source tool that transforms object storage into a Git-like repositories. Prior to version 1.81.1 of the open source edition and 1.84.0 of the enterprise edition, lakeFS Web UI renders markdown files from repository objects without sanitizing the resulting HTML. A user with write access to any repository branch can commit a `.md` object containing arbitrary HTML/JavaScript. Any other user who opens that object, or who navigates to a repository or directory containing a malicious `README.md`, executes the attacker-supplied script in their own authenticated session. lakeFS fixes the issue in v1.81.1 and lakeFS Enterprise fixes the issue in in v1.84.0. Enterprise customers using older versions can temporarily disable Markdown rendering by adding YAML to their config. No workaround exists for OSS release. Users are advised to upgrade to the latest version for both lakeFS and lakeFS-Enterprise.
AI Analysis
Technical Summary
The vulnerability CVE-2026-48026 in lakeFS arises from improper neutralization of input during web page generation (CWE-79). Specifically, the lakeFS Web UI prior to version 1.81.1 (open source) and 1.84.0 (enterprise) renders markdown files from repository objects without sanitizing the resulting HTML content. A user with write access can commit a `.md` file containing arbitrary HTML or JavaScript code. When other users view this file or navigate to a directory containing a malicious README.md, the embedded script executes in their authenticated session, potentially leading to session hijacking or other impacts. The issue is resolved in lakeFS 1.81.1 and lakeFS Enterprise 1.84.0. Enterprise users on older versions can disable Markdown rendering via YAML configuration as a temporary mitigation. No workaround exists for the open source edition. The CVSS v3.1 score is 8.7 (high), reflecting network attack vector, low attack complexity, required privileges of low, user interaction required, scope changed, and high impact on confidentiality and integrity with no impact on availability.
Potential Impact
Successful exploitation allows an attacker with write access to inject malicious scripts into markdown files rendered by the lakeFS Web UI. These scripts execute in the context of other users' authenticated sessions when they view the malicious files or directories containing them. This can lead to disclosure of sensitive information, session hijacking, or other unauthorized actions within the affected application. The vulnerability does not impact availability. The high CVSS score reflects the significant confidentiality and integrity impact.
Mitigation Recommendations
A fix is available in lakeFS version 1.81.1 (open source) and lakeFS Enterprise version 1.84.0. Users should upgrade to these versions to remediate the vulnerability. Enterprise customers using older versions can temporarily mitigate the issue by disabling Markdown rendering via YAML configuration settings. There is no workaround available for the open source edition other than upgrading. Users are advised to apply the official fixes promptly.
CVE-2026-48026: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in treeverse lakeFS
Description
lakeFS is an open-source tool that transforms object storage into a Git-like repositories. Prior to version 1.81.1 of the open source edition and 1.84.0 of the enterprise edition, lakeFS Web UI renders markdown files from repository objects without sanitizing the resulting HTML. A user with write access to any repository branch can commit a `.md` object containing arbitrary HTML/JavaScript. Any other user who opens that object, or who navigates to a repository or directory containing a malicious `README.md`, executes the attacker-supplied script in their own authenticated session. lakeFS fixes the issue in v1.81.1 and lakeFS Enterprise fixes the issue in in v1.84.0. Enterprise customers using older versions can temporarily disable Markdown rendering by adding YAML to their config. No workaround exists for OSS release. Users are advised to upgrade to the latest version for both lakeFS and lakeFS-Enterprise.
CVSS v3.1
Score 8.7high
Affected software
treeverse
lakeFS
treeverse
lakeFS-enterprise
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability CVE-2026-48026 in lakeFS arises from improper neutralization of input during web page generation (CWE-79). Specifically, the lakeFS Web UI prior to version 1.81.1 (open source) and 1.84.0 (enterprise) renders markdown files from repository objects without sanitizing the resulting HTML content. A user with write access can commit a `.md` file containing arbitrary HTML or JavaScript code. When other users view this file or navigate to a directory containing a malicious README.md, the embedded script executes in their authenticated session, potentially leading to session hijacking or other impacts. The issue is resolved in lakeFS 1.81.1 and lakeFS Enterprise 1.84.0. Enterprise users on older versions can disable Markdown rendering via YAML configuration as a temporary mitigation. No workaround exists for the open source edition. The CVSS v3.1 score is 8.7 (high), reflecting network attack vector, low attack complexity, required privileges of low, user interaction required, scope changed, and high impact on confidentiality and integrity with no impact on availability.
Potential Impact
Successful exploitation allows an attacker with write access to inject malicious scripts into markdown files rendered by the lakeFS Web UI. These scripts execute in the context of other users' authenticated sessions when they view the malicious files or directories containing them. This can lead to disclosure of sensitive information, session hijacking, or other unauthorized actions within the affected application. The vulnerability does not impact availability. The high CVSS score reflects the significant confidentiality and integrity impact.
Mitigation Recommendations
A fix is available in lakeFS version 1.81.1 (open source) and lakeFS Enterprise version 1.84.0. Users should upgrade to these versions to remediate the vulnerability. Enterprise customers using older versions can temporarily mitigate the issue by disabling Markdown rendering via YAML configuration settings. There is no workaround available for the open source edition other than upgrading. Users are advised to apply the official fixes promptly.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-20T17:44:09.587Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a765f31bf8831d539483951
Added to database: 08/07/2026, 22:41:53 UTC
Last enriched: 08/15/2026, 14:42:39 UTC
Last updated: 09/21/2026, 22:01:35 UTC
Views: 68
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.