Threats tagged 'ghsa-vg7f-4c95-cv88'

A reflected cross-site scripting (XSS) vulnerability exists in Red Hat Quay's v1 registry API error handler. The flaw occurs because the error handler reflects the attacker-supplied image_id path segment in an HTML response, allowing execution of arbitrary JavaScript if a user visits a crafted URL. Exploitation requires user interaction and anonymous access to a public repository, which is enabled by default. This can lead to session compromise or other malicious actions within the Quay origin.