The Galaxy Project Galaxy version v14.10 contains a CWE-79: Improper Neutralization of…
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
The Galaxy Project Galaxy version v14.10 contains a CWE-79: Improper Neutralization of Input During Web Page Generation vulnerability in Many templates used in the Galaxy server did not properly sanitize user's input, which would allow for cross-site scripting (XSS) attacks. In this form of attack, a malicious person can create a URL which, when opened by a Galaxy user or administrator, would allow the malicious user to execute arbitrary Javascript. that can result in Arbitrary JavaScript code execution. This attack appear to be exploitable via The victim must interact with component on page witch contains injected JavaScript code.. This vulnerability appears to have been fixed in v14.10.1, v15.01.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | galaxy-app (PyPI) | before 14.10.1 | 14.10.1 | Patch available | GHSA-qqr6-vm23-m488 |
| — | galaxy-app (PyPI) | 15.0 to before 15.01 | 15.01 | Patch available | GHSA-qqr6-vm23-m488 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- galaxy-app (PyPI) Vendor— Affected before 14.10.1 Fixed in 14.10.1 Patch available GHSA-qqr6-vm23-m488
- galaxy-app (PyPI) Vendor— Affected 15.0 to before 15.01 Fixed in 15.01 Patch available GHSA-qqr6-vm23-m488
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:galaxyproject:galaxy:14.10:*:*:*:*:*:*:* | 14.10 | Vulnerable | galaxyproject |
- cpe:2.3:a:galaxyproject:galaxy:14.10:*:*:*:*:*:*:* Versions 14.10 Vulnerable ·galaxyproject
Remediation
- Fix · GHSA-qqr6-vm23-m488 galaxy-app (PyPI) Fixed in 14.10.1 Advisory →
- Fix · GHSA-qqr6-vm23-m488 galaxy-app (PyPI) Fixed in 15.01 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2018-1000516
- 2026-10-03 Alias added: GHSA-qqr6-vm23-m488
References
More galaxyproject Galaxy vulnerabilities
- TI-2023-22903 Galaxy vulnerable to Server Side Request Forgery during data imports CVSS 3.1MEDIUM 6.3
- TI-2023-12288 Galaxy vulnerable to unauthorized modification of pages/visualizations due to insufficient permission check CVSS 3.1CRITICAL 9.1
- TI-2022-07530 Arbitrary file access in the Galaxy data analysis platform CVSS 3.1HIGH 8.6
- TI-2015-07990 galaxy-data-resource Command Line Template injection CVSS 3.1CRITICAL 9.8
- TI-2024-28338 Possible Data Tampering & Loss of Public Datasets in Galaxy CVSS 3.1CRITICAL 9.1
- TI-2024-28333 Stored Cross Site Scripting (Stored XSS) in Galaxy CVSS 3.1HIGH 7.6
Sources
- CVE-2018-1000516 · CVE Program
- CVE-2018-1000516 · NVD
- FIRST EPSS
- GHSA-qqr6-vm23-m488 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences