CVE-2026-55422— conda-forge.org: Stored DOM XSS via unsanitized dangerouslySetInnerHTML in the status dashboard
Quick assessment
Affected
conda-forge conda-forge.github.io
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
conda-forge 是一个托管在 GitHub 上的组织，其中包含 conda 配方（recipes）的仓库。在提交 85748ad2368a 及其之前的版本中，两个 React 组件通过 dangerouslySetInnerHTML 直接将外部来源的字符串渲染为 HTML，且未进行任何净化处理（该项目并未依赖 DOMPurify 或同类库）。JSON 文件由 conda-forge 的自动更新机器人（regro/cf-scripts）在自动处理每个 conda-forge 配方及其上游源代码制品时生成。这些
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| conda-forge | conda-forge.github.io | <= 85748ad2368a |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-55422
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
conda-forge.org: Stored DOM XSS via unsanitized dangerouslySetInnerHTML in the status dashboard
Source: CVE Program / CVE List V5
Vulnerability Description
conda-forge is a GitHub organization containing repositories of conda recipes. In commits 85748ad2368a and prior, two React components render externally-sourced strings directly as HTML using dangerouslySetInnerHTML, with no sanitization (the project has no DOMPurify or equivalent dependency). JSON files are produced automatically by the conda-forge autotick bot (regro/cf-scripts) while it processes every conda-forge feedstock and its upstream source artifacts. The error/status strings embed raw output captured from those processes (build logs, patch output, tracebacks). The website renders them verbatim as HTML. At time of publication, there are no publicly available patches.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| conda-forge | conda-forge.github.io | <= 85748ad2368a | - |
|
II. Public POCs for CVE-2026-55422
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-55422
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-55422 (1)
IV. Related Vulnerabilities
Same vendor: conda-forge
-
CVE-2026-46699
conda-smithy vulnerable to misrouted repository invitation b -
CVE-2025-49824
conda-smithy Insecure Encryption Vulnerable to Oracle Paddin -
CVE-2025-49843
conda-smithy Has Incorrect Default File Permissions -
CVE-2025-49842
conda-forge-webservices Privilege Escalation Risk via Defaul -
CVE-2025-49598
conda-forge-ci-setup Allows Arbitrary Code Execution via Ins
Same weakness: CWE-79
-
CVE-2026-115897
Serialize JavaScript: Cross-site scripting (XSS) via unescap -
CVE-2026-87901
注册模块不当清理导致反射型跨站脚本漏洞 -
CVE-2026-102786
Joomla Extension - phoca.cz - Authenticated stored cross-sit -
CVE-2026-55486
Goobi viewer: IIIF Auth 2.0 origin parameter unsanitized — C -
CVE-2026-112333
GFI Archiver < 15.14 Stored XSS via MailInsights.aspx
V. Comments for CVE-2026-55422
No comments yet