Skip to content
Submit incident
AII-1002-52067
ConfirmedA court, a regulator or the organization itself has stated the core facts, or the record cites a court or regulator source.

Stored XSS in Kubeflow Pipeline View (CVE-2024-9526)

A stored cross-site scripting (XSS) vulnerability was identified in Kubeflow Pipelines' frontend component that could allow raw HTML parsing in markdown rendering. A fix was implemented by disabling the HTML parsing option in the markdown-to-jsx component.

19 December 2023 · Kubeflow · Security and cyberattacks
19 December 2023

Drafted by Raidu Incident Detection, an automated system.

AII-1002-520672 sources ↓
Quick facts
Organization
Kubeflow (subject)
Category
Security and cyberattacks
Source
github.com
Date
19 December 2023
Drafted by
Raidu Incident Detection

What happened

A stored XSS vulnerability was present in Kubeflow Pipelines' frontend that allowed raw HTML to be parsed in markdown rendering. The vulnerability was addressed through a pull request that added a disableParsingRawHTML option to the markdown-to-jsx component, which was merged on December 19, 2023.

Classification

Organization
Kubeflow (subject)
Category
Security and cyberattacks
Industry
IT infrastructure and hosting
Harm status
Potential harm
Intent
Unintentional
Timing
Post-deployment
AI systems
Kubeflow Pipelines

Sources and evidence

This record was researched and written by the Index, based on the following original reporting.

github.com
https://github.com/kubeflow/pipelines/pull/10315
cve.org
NVD entry