Answer in brief
CVE-2026-48026 records a Unknown severity vulnerability in lakeFS vulnerable to stored XSS in rendered markdown previews via raw HTML. The current sources do not mark it as known exploited. The current feed maps treeverse/lakeFS (generic), treeverse/lakeFS-enterprise (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps treeverse/lakeFS (generic), treeverse/lakeFS-enterprise (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| treeverse/lakeFSgeneric | < 1.81.1 | Not reported |
| treeverse/lakeFS-enterprisegeneric | < 1.84.0 | Not reported |
Published upstream
Aug 7, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 7, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 7, 2026
lakeFS is an open-source tool that transforms object storage into a Git-like repositories. Prior to version 1.81.1 of the open source edition and 1.84.0 of the enterprise edition, lakeFS Web UI renders markdown files from repository objects without sanitizing the resulting HTML. A user with write access to any repository branch can commit a `.md` object containing arbitrary HTML/JavaScript. Any other user who opens that object, or who navigates to a repository or directory containing a malicious `README.md`, executes the attacker-supplied script in their own authenticated session. lakeFS fixes the issue in v1.81.1 and lakeFS Enterprise fixes the issue in in v1.84.0. Enterprise customers using older versions can temporarily disable Markdown rendering by adding YAML to their config. No workaround exists for OSS release. Users are advised to upgrade to the latest version for both lakeFS and lakeFS-Enterprise.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-48026 records a Unknown severity vulnerability in lakeFS vulnerable to stored XSS in rendered markdown previews via raw HTML. The current sources do not mark it as known exploited. The current feed maps treeverse/lakeFS (generic), treeverse/lakeFS-enterprise (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps treeverse/lakeFS (generic), treeverse/lakeFS-enterprise (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| treeverse/lakeFSgeneric | < 1.81.1 | Not reported |
| treeverse/lakeFS-enterprisegeneric | < 1.84.0 | Not reported |
Published upstream
Aug 7, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 7, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 7, 2026
lakeFS is an open-source tool that transforms object storage into a Git-like repositories. Prior to version 1.81.1 of the open source edition and 1.84.0 of the enterprise edition, lakeFS Web UI renders markdown files from repository objects without sanitizing the resulting HTML. A user with write access to any repository branch can commit a `.md` object containing arbitrary HTML/JavaScript. Any other user who opens that object, or who navigates to a repository or directory containing a malicious `README.md`, executes the attacker-supplied script in their own authenticated session. lakeFS fixes the issue in v1.81.1 and lakeFS Enterprise fixes the issue in in v1.84.0. Enterprise customers using older versions can temporarily disable Markdown rendering by adding YAML to their config. No workaround exists for OSS release. Users are advised to upgrade to the latest version for both lakeFS and lakeFS-Enterprise.
Quoted source text, attributed separately from HOL analysis.