The vulnerability occurs because lakeFS Web UI renders markdown files from repository objects without sanitizing the resulting HTML. A user with write permissions to any branch can commit a .md file that contains arbitrary HTML or JavaScript. When any other user opens that file, or navigates to a repository or directory that contains a malicious README.md, the attacker‑supplied script executes in the context of the viewer’s authenticated browser session. This stored Cross‑Site Scripting flaw can lead to disclosure of sensitive data, session hijacking, or further client‑side code execution, effectively providing remote code execution capability within the user’s session.

vulnerable products are treeverse:lakeFS and treeverse:lakeFS-enterprise. In the open‑source edition versions earlier than 1.81.1 are affected; in the enterprise edition versions earlier than 1.84.0 are affected.

The CVSS score of 8.7 indicates a high‑severity risk. Exploitation requires no special conditions beyond having write access to a repository branch and a user who views the malicious markdown. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the lack of input sanitization makes the attack vector straightforward via the Web UI. Given the ease of payload construction and the ability to trigger the script in any authenticated session, the likelihood of exploitation is high for organizations that allow broad write access to repository branches.