CVE-2024-9526 Stored XSS in Kubeflow Pipeline View
Attackers can inject malicious scripts via pipeline descriptions in Kubeflow, potentially executing code or hijacking user sessions.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-9526?
CVE-2024-9526 is a high-severity cross-site scripting vulnerability in Kubeflow Pipeline View, published on 18 Nov 2024. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
There exists a stored XSS Vulnerability in Kubeflow Pipeline View web UI. The Kubeflow Web UI allows to create new pipelines. When creating a new pipeline, it is possible to add a description. The description field allows html tags, which are not filtered properly. Leading to a stored XSS. We recommend upgrading past commit 930c35f1c543998e60e8d648ce93185c9b5dbe8d
Weakness: CWE-79
Which versions are affected by CVE-2024-9526?
1 open source package ship an affected version, including github.com/kubeflow/pipelines. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/kubeflow/pipelines Go | All versions | None |
Products include Kubeflow Pipelines.
How do I fix CVE-2024-9526?
Apply the vendor's patch.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-9526 being exploited?
There is no known exploitation of CVE-2024-9526 in the wild and no public exploit code.
Sources
Also known as GHSA-rm25-8wjq-c6qm, GO-2024-3278.