{"answers":{"affected":"3 open source packages ship an affected version, including github.com/treeverse/lakefs.","exploited":"There is no known exploitation of GHSA-9phh-r37v-34wh in the wild and no public exploit code.","fix":"Upgrade github.com/treeverse/lakefs to 0.106.0 or later.","what":"GHSA-9phh-r37v-34wh is a cross-site scripting vulnerability in github.com/treeverse/lakefs, published on 14 Aug 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for GHSA-9phh-r37v-34wh and fix it if it is affected.\n\nWhat it is: GHSA-9phh-r37v-34wh is a cross-site scripting vulnerability in github.com/treeverse/lakefs, published on 14 Aug 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.\nExploitation: There is no known exploitation of GHSA-9phh-r37v-34wh in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- github.com/treeverse/lakefs (Go): affected all versions; fixed in 0.106.0\n- github.com/treeverse/lakefs (Go): affected all versions; fixed in 0.106.0\n- github.com/treeverse/lakefs (Go): affected all versions; fixed in 0.106.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-9phh-r37v-34wh/ (Markdown: https://insights.sbomify.com/GHSA-9phh-r37v-34wh/index.md)","id":"GHSA-9phh-r37v-34wh","markdown":"https://insights.sbomify.com/GHSA-9phh-r37v-34wh/index.md","name":"GHSA-9phh-r37v-34wh","record":{"aliases":["GO-2023-2012"],"analysis":{"component_type":"web_application","fix_type":"upgrade","impacts":["account_takeover","data_read"],"network_reachable":"yes","non_default_config":false,"product_category":"lakeFS storage platform","requires_auth":"low_privilege","summary":"Attackers with upload access can inject malicious JavaScript into HTML files, leading to session hijacking or data theft when victims open direct links.","user_interaction":"required","vuln_class":"xss"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"### Impact\nThe browser renders the resulting HTML when opening a direct link to an HTML file via lakeFS. Any JavaScript within that page is executed within the context of the domain lakeFS is running in.  \nAn attacker can inject a malicious script inline, download resources from another domain, or make arbitrary HTTP requests. This would allow the attacker to send information to a random domain or carry out lakeFS operations while impersonating the victim.  \n\nNote that to carry out this attack, an attacker must already have access to upload the malicious HTML file to one or more repositories. It also depends on the victim receiving and opening the link to the malicious HTML file.\n\n### Patches\nThis is fixed in lakeFS version 0.106.0\n\n### Workarounds\nThere are no known workarounds at this time.","ecosystems":["Go"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files","id":"GHSA-9phh-r37v-34wh","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"Go","product":null,"products":[],"type":"xss","year":"2023"},"n_packages":3,"n_references":null,"packages":[{"ecosystem":"Go","fixed":["0.106.0"],"introduced":["0"],"last_affected":[],"package":"github.com/treeverse/lakefs","purl":null,"source":"GHSA-9phh-r37v-34wh"},{"ecosystem":"Go","fixed":["0.106.0"],"introduced":["0"],"last_affected":[],"package":"github.com/treeverse/lakefs","purl":"pkg:golang/github.com/treeverse/lakefs","source":"GHSA-9phh-r37v-34wh"},{"ecosystem":"Go","fixed":["0.106.0"],"introduced":["0"],"last_affected":[],"package":"github.com/treeverse/lakefs","purl":"pkg:golang/github.com/treeverse/lakefs","source":"GO-2023-2012"}],"products":null,"published":"2023-08-14","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"Go Vulnerability Database","prefix":"GO"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Attackers with upload access can inject malicious JavaScript into HTML files, leading to session hijacking or data theft when victims open direct links.","url":"https://insights.sbomify.com/GHSA-9phh-r37v-34wh/"}