CVE-2024-9526
- Source
- https://cve.org/CVERecord?id=CVE-2024-9526
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-9526.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2024-9526
- Aliases
- Downstream
- Related
- Published
- 2024-11-18T13:30:21Z
- Modified
- 2026-09-30T03:48:01Z
- Severity
-
- 7.1 (High) CVSS_V4 - CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/S:P/AU:Y/R:U/V:D/RE:L/U:Green CVSS Calculator
- Summary
- Stored XSS in Kubeflow Pipeline View
- Details
-
There exists a stored XSS Vulnerability in Kubeflow Pipeline View web UI. The Kubeflow Web UI allows to create new pipelines. When creating a new pipeline, it is possible to add a description. The description field allows html tags, which are not filtered properly. Leading to a stored XSS. We recommend upgrading past commit 930c35f1c543998e60e8d648ce93185c9b5dbe8d
- Database specific
{ "cna_assigner": "Google", "cwe_ids": [ "CWE-79" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/9xxx/CVE-2024-9526.json" }- References