External build logs, patch output, and tracebacks are embedded in JSON files generated by the conda‑forge autotick bot and rendered by two React components using dangerouslySetInnerHTML without any sanitization. Because the strings are inserted directly as HTML, a malicious actor who can influence the build process could inject arbitrary HTML or JavaScript, causing the browser to execute the code when a user views the status dashboard. The immediate consequence is client‑side code execution, which could lead to session hijacking, credential theft, or the delivery of further payloads to those users. The weakness is a classic Stored DOM XSS reflected in the affected components and is categorized as CWE‑79.

The vulnerability resides in the conda‑forge.github.io site managed by the conda‑forge GitHub organization. Any instance of the homepage using website commits prior to 85748ad2368a is affected, as those commits contain the unsanitized React components. Users who view the status dashboard that displays build logs processed by the autotick bot are potentially exposed.

The CVSS score of 4.6 indicates a moderate overall risk. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited evidence of exploitation. The attack vector is stored web content: an attacker would need to inject malicious output into a build log that the autotick bot later publishes. Because the vulnerable code runs on a publicly reachable site, any user who visits the status dashboard could be impacted, but no direct remote code execution on the server itself is possible. Overall, the risk is medium, with exploitation plausibility contingent upon the attacker’s ability to influence build outputs.