CVE-2024-42346

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Galaxy is a free, open-source system for analyzing data, authoring workflows, training and education, publishing tools, managing infrastructure, and more. The editor visualization, /visualizations endpoint, can be used to store HTML tags and trigger javascript execution upon edit operation. All supported branches of Galaxy (and more back to release_20.05) were amended with the supplied patches. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
galaxyproject	galaxy	< 24.1.1

References

https://github.com/galaxyproject/galaxy/security/advisories/GHSA-x6w7-3gwf-qr9rPatch, Vendor Advisory

Timeline

Published: Sep 20, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-423476.5matrix-react-sdk is a react-based SDK for inserting a Matrix chat/voip client into a web page. A malicious homeserver could manipulate a us CVE-2024-423488.6FOG is a cloning/imaging/rescue suite/inventory management system. FOG Server 1.5.10.41.2 can leak AD username and password when registering CVE-2024-423495.3FOG is a cloning/imaging/rescue suite/inventory management system. FOG Server 1.5.10.41.4 and earlier can leak authorized and rejected login CVE-2024-42354.9A vulnerability classified as problematic was found in Netgear DG834Gv5 1.6.01.34. This vulnerability affects unknown code of the component CVE-2024-423503.0Biscuit is an authorization token with decentralized verification, offline attenuation and strong security policy enforcement based on a log CVE-2024-423519.1Galaxy is a free, open-source system for analyzing data, authoring workflows, training and education, publishing tools, managing infrastruct CVE-2024-423527.5Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. `nuxt/icon` provides an API to allo CVE-2024-423536.1WebOb provides objects for HTTP requests and responses. When WebOb normalizes the HTTP Location header to include the request hostname, it d CVE-2024-423545.9Shopware is an open commerce platform. The store-API works with regular entities and not expose all fields for the public API; fields need t CVE-2024-423559.8Shopware, an open ecommerce platform, has a new Twig Tag `sw_silent_feature_call` which silences deprecation messages while triggered in thi CVE-2024-423567.2Shopware is an open commerce platform. Prior to versions 6.6.5.1 and 6.5.8.13, the `context` variable is injected into almost any Twig Templ CVE-2024-423579.8Shopware is an open commerce platform. Prior to versions 6.6.5.1 and 6.5.8.13, the Shopware application API contains a search functionality