Description

lakeFS is an open-source tool that transforms object storage into a Git-like repositories. Prior to version 1.81.1 of the open source edition and 1.84.0 of the enterprise edition, lakeFS Web UI renders markdown files from repository objects without sanitizing the resulting HTML. A user with write access to any repository branch can commit a `.md` object containing arbitrary HTML/JavaScript. Any other user who opens that object, or who navigates to a repository or directory containing a malicious `README.md`, executes the attacker-supplied script in their own authenticated session. lakeFS fixes the issue in v1.81.1 and lakeFS Enterprise fixes the issue in in v1.84.0. Enterprise customers using older versions can temporarily disable Markdown rendering by adding YAML to their config. No workaround exists for OSS release. Users are advised to upgrade to the latest version for both lakeFS and lakeFS-Enterprise.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.7",
  "pubDate": "2026-08-07T23:17:03.810Z",
  "pubdate": "2026-08-07T23:17:03.810Z",
  "executiveSummary": "A stored Cross-Site Scripting (XSS) vulnerability exists in the lakeFS Web UI, affecting the open-source edition prior to version 1.81.1 and the enterprise edition prior to version 1.84.0. The vulnerability stems from the application rendering markdown files from repository objects without properly sanitizing the resulting HTML output.\nAn authenticated attacker with write access to any repository branch can exploit this flaw by committing a maliciously crafted .md object, such as a README.md file, containing arbitrary HTML and JavaScript payloads. When another authenticated user views the object, repository, or containing directory through the Web UI, the injected script executes within the victim's authenticated session.\nThe impact of successful exploitation includes potential session hijacking, unauthorized actions performed on behalf of the victim, and data exposure within the context of the affected user's session. Exploitation requires write access to a repository branch and user interaction in the form of navigating to or opening the malicious markdown object.\nEnterprise customers operating vulnerable versions can temporarily mitigate the risk by configuring YAML settings to disable Markdown rendering. However, no direct workaround is available for the open-source edition, necessitating an upgrade to the patched releases for complete remediation.",
  "technicalDetails": "The root cause of the vulnerability resides in the lakeFS Web UI rendering pipeline, which fails to sanitize HTML output generated from markdown parsing of repository objects. Specifically, when rendering markdown files stored within repository objects, the application processes attacker-controlled input and inserts raw HTML directly into the DOM.\nThe vulnerable component is the markdown rendering module within the lakeFS Web UI. The affected software includes lakeFS open-source edition prior to version 1.81.1 and lakeFS Enterprise prior to version 1.84.0.\nTo execute an attack, an actor must possess write access to a repository branch within lakeFS, allowing them to commit arbitrary files. The attacker crafts a malicious markdown file, such as a .md object or a specially named README.md, embedding arbitrary HTML and JavaScript payloads. Because input validation and sanitization are missing during the rendering process, the raw payload is stored persistently in the repository.\nThe attack flow proceeds as follows: 1) The attacker commits the malicious .md object to a repository branch. 2) A victim user navigates to the repository, directory, or directly opens the malicious markdown object within the lakeFS Web UI. 3) The Web UI retrieves the object and parses the markdown, generating unescaped HTML that contains the injected JavaScript. 4) The browser executes the payload within the victim's authenticated session.\nPost-exploitation impact is dictated by the privileges of the victim viewing the rendered markdown. Because the script executes in the context of the victim's authenticated session, it can leverage the user's browser session to interact with the lakeFS API, potentially performing unauthorized actions, accessing sensitive repository data, or executing further client-side attacks.\nAuthentication is required to commit the malicious payload (write access) and to trigger the execution (accessing the Web UI), while network exposure is bounded by the accessibility of the lakeFS Web UI instance."
}