CVE-2026-48026

Received Received - Intake

XSS in lakeFS Web UI via Unsanitized Markdown Rendering

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: GitHub, Inc.

Description

lakeFS is an open-source tool that transforms object storage into a Git-like repositories. Prior to version 1.81.1 of the open source edition and 1.84.0 of the enterprise edition, lakeFS Web UI renders markdown files from repository objects without sanitizing the resulting HTML. A user with write access to any repository branch can commit a `.md` object containing arbitrary HTML/JavaScript. Any other user who opens that object, or who navigates to a repository or directory containing a malicious `README.md`, executes the attacker-supplied script in their own authenticated session. lakeFS fixes the issue in v1.81.1 and lakeFS Enterprise fixes the issue in in v1.84.0. Enterprise customers using older versions can temporarily disable Markdown rendering by adding YAML to their config. No workaround exists for OSS release. Users are advised to upgrade to the latest version for both lakeFS and lakeFS-Enterprise.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-07

Last Modified

2026-08-07

Generated

2026-08-08

AI Q&A

2026-08-08

EPSS Evaluated

N/A

NVD

CVE-2026-48026

Affected Vendors & Products

Vendor	Product	Version / Range
lakefs	lakefs	to 1.81.1 (exc)
lakefs	lakefs_enterprise	to 1.84.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

lakeFS is a tool that turns object storage into Git-like repositories. Before versions 1.81.1 (open source) and 1.84.0 (enterprise), its Web UI rendered markdown files without sanitizing the resulting HTML. A user with write access could commit a malicious .md file containing HTML/JavaScript. When others view this file or a directory containing it, the script executes in their authenticated session.

Detection Guidance

Check lakeFS version with 'curl -s http://<lakeFS-server>/api/v1/config | grep version' or 'lakefs --version'. If using OSS and version is below 1.81.1, or Enterprise below 1.84.0, the system is vulnerable. Inspect repository branches for .md files with suspicious HTML/JavaScript content.

Impact Analysis

An attacker with write access could steal session cookies, perform actions on your behalf, or access sensitive data. Even users with read-only access are affected if they view the malicious file or directory. The impact is limited to authenticated users within lakeFS.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR (data protection) and HIPAA (health data privacy). Organizations using lakeFS must ensure proper access controls and patch systems to maintain compliance.

Mitigation Strategies

Upgrade lakeFS to v1.81.1 (OSS) or v1.84.0 (Enterprise). For Enterprise users on older versions, add YAML config to disable Markdown rendering temporarily. No workaround exists for OSS releases.

Hi! I’m here to help you understand CVE-2026-48026. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70