lakeFS versions before 1.81.1 (open source) and 1.84.0 (enterprise) do not sanitize HTML generated from markdown files in the Web UI, allowing a user with write access to commit a `.md` file containing arbitrary HTML/JavaScript. This results in a stored cross-site scripting vulnerability (CWE-79) where other users opening or browsing to affected markdown files execute attacker-supplied scripts in their authenticated sessions. The vulnerability has a CVSS 3.1 score of 8.7 (high severity) with network attack vector, low attack complexity, requiring privileges and user interaction, and impacts confidentiality and integrity with no availability impact. lakeFS fixed the issue in the specified versions. Enterprise customers can temporarily mitigate by disabling Markdown rendering via YAML config, but no workaround exists for the open source edition.

Successful exploitation allows an attacker with write access to inject malicious scripts into markdown files that execute in the context of other users' authenticated sessions. This can lead to theft of sensitive information, session hijacking, or other actions performed with the victim's privileges. The vulnerability impacts confidentiality and integrity but does not affect availability.

A fix is available in lakeFS open source edition version 1.81.1 and lakeFS Enterprise edition version 1.84.0. Users should upgrade to these versions or later. Enterprise customers using older versions can temporarily disable Markdown rendering by adding YAML configuration as a workaround. No workaround exists for the open source edition. Users should follow vendor guidance for upgrading and configuration changes.