Cross-Site Scripting Vulnerability in Conda-Forge Web Interface
CVE-2026-55422

4.6MEDIUM

Key Information:

Vendor

Conda-forge

Status
Conda-forge.github.io
Vendor
CVE Published:
23 October 2026

What is CVE-2026-55422?

Conda-Forge has a security vulnerability within its web interface due to the usage of React components that render externally sourced strings directly as HTML without proper sanitization. This flaw allows for potential cross-site scripting (XSS) attacks, where malicious scripts can be executed in the context of the user’s browser. The affected components fail to utilize DOMPurify or a similar library for sanitization, putting users at risk as raw output from build logs and other processes can contain harmful content. At this time, there are no available patches to mitigate this issue.

Affected Version(s)

conda-forge.github.io <= 85748ad2368a

References

https://github.com/conda-forge/conda-forge.github.io/secu...
x_refsource_CONFIRM

CVSS V3.1

Score:
4.6
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.