Read the docs
TI-2026-79755 Aliases CVE-2026-55422

Stored cross-site scripting in conda-forge status dashboard

Priority LOW 20CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

conda-forge.github.io up to and including commit 85748ad2368a renders externally sourced strings as HTML. Two React components pass these strings to dangerouslySetInnerHTML without sanitization, which enables stored cross-site scripting (CWE-79). Raw build logs and tracebacks captured by the autotick bot are stored there, so a low-privileged attacker can plant script that runs when a user views the dashboard.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

conda-forge is a GitHub organization containing repositories of conda recipes. In commits 85748ad2368a and prior, two React components render externally-sourced strings directly as HTML using dangerouslySetInnerHTML, with no sanitization (the project has no DOMPurify or equivalent dependency). JSON files are produced automatically by the conda-forge autotick bot (regro/cf-scripts) while it processes every conda-forge feedstock and its upstream source artifacts. The error/status strings embed raw output captured from those processes (build logs, patch output, tracebacks). The website renders them verbatim as HTML. At time of publication, there are no publicly available patches.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00162 5th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
conda-forgeconda-forge.github.ioup to 85748ad2368a—No fix listedCNA
  • conda-forge.github.io Vendorconda-forge Affected up to 85748ad2368a Fixed in — No fix listed CNA

Remediation

No fixed version is listed for conda-forge.github.io, and no public patch existed at publication.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

  1. 2026-10-23 Threatist record created from CVE-2026-55422
  2. 2026-10-29 CISA SSVC decision points changed

References

Other 1

  • TI-2025-20342 RCE in the package conda-forge-metadata CVSS 4.0CRITICAL 9.3
  • TI-2025-24594 conda-forge openssl-feedstock writable OPENSSLDIR CVSS 4.0HIGH 7.0
  • TI-2025-31611 conda-forge-ci-setup Allows Arbitrary Code Execution via Insecure Version Parsing CVSS 4.0MEDIUM 4.4
  • TI-2025-22665 conda-forge infrastructure uses a bad token for Azure's cf-staging access CVSS 4.0CRITICAL 9.3
  • TI-2025-23821 conda-forge-webservices has an Unauthorized Artifact Modification Race Condition CVSS 4.0HIGH 7.5
  • TI-2026-34328 Improper access control in conda-forge conda-smithy CVSS 3.1HIGH 7.6
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences