Threats tagged 'ghsa-g3qx-frcg-j979'

Kubeflow Pipelines frontend versions prior to 2.15.0 contain a reflected cross-site scripting (XSS) vulnerability in the pod information and pod events error responses. The vulnerability arises because untrusted pod names and namespaces are reflected in HTML error messages without proper validation, allowing an attacker to craft links that execute JavaScript in the frontend's origin when visited by an authenticated user. Exploitation requires the victim to follow a malicious link and meet the deployment's authentication and route access controls. The vulnerability does not enable server-side code execution or guaranteed cookie theft. The issue was fixed in version 2.15.0 by validating resource names and sanitizing error responses.