Read the docs
TI-2022-10774 Aliases CVE-2022-27894GHSA-3prr-8gr9-v5cq

Cross-site scripting in Palantir Foundry Blobster Service

Priority LOW 25CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

The Foundry Blobster service was found to have a cross-site scripting (XSS) vulnerability that could have allowed an attacker with access to Foundry to launch attacks against other users. This vulnerability is resolved in Blobster 3.228.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00406 35th percentileScored 2026-11-07
Fix Fixed Foundry Blobster Service (Palantir): 3.227.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
PalantirFoundry Blobster Servicebefore 3.227.0; next of 3.207.0 and later3.227.0Patch availableCNA
  • Foundry Blobster Service VendorPalantir Affected before 3.227.0; next of 3.207.0 and later Fixed in 3.227.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:palantir:foundry_blobster:*:*:*:*:*:*:*:*3.207.0 to before 3.227.0VulnerablePalantir
  • cpe:2.3:a:palantir:foundry_blobster:*:*:*:*:*:*:*:* Versions 3.207.0 to before 3.227.0 Vulnerable ·Palantir

Remediation

  • Fix · CNA Foundry Blobster Service (Palantir) Fixed in 3.227.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-27894
  2. 2026-10-03 Alias added: GHSA-3prr-8gr9-v5cq

References

Advisory 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences