CVE-2026-55422

MediumCVSS 4.6/10Last modified Oct 23, 2026

Description

conda-forge is a GitHub organization containing repositories of conda recipes. In commits 85748ad2368a and prior, two React components render externally-sourced strings directly as HTML using dangerouslySetInnerHTML, with no sanitization (the project has no DOMPurify or equivalent dependency). JSON files are produced automatically by the conda-forge autotick bot (regro/cf-scripts) while it processes every conda-forge feedstock and its upstream source artifacts. The error/status strings embed raw output captured from those processes (build logs, patch output, tracebacks). The website renders them verbatim as HTML. At time of publication, there are no publicly available patches.

Metrics

CVSS 3.1 4.6/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Oct 23, 2026
Last modified: Oct 23, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-554236.1Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.7.0, the logout button does not clear the session.CVE-2026-554245.4Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, a topic "featured link" was not suffic CVE-2026-554255.0Graylog is a free and open log management platform. From 7.1.0 until 7.1.4 and 7.2.0-alpha.2, the System Catalog entity titles endpoint in g CVE-2026-554267.8linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations, and Linuxfabrik Monitoring Plug CVE-2026-554278.3Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2,CVE-2026-554288.2Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2,CVE-2026-554298.7Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2,CVE-2026-55436.3A vulnerability was identified in PHPGurukul User Registration & Login and User Management System 3.3. The affected element is an unknown fu CVE-2026-554306.8Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2,CVE-2026-554316.1Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2,CVE-2026-554325.4Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2,CVE-2026-554335.4Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2,