An authenticated cross-site scripting vulnerability in lakeFS poses a high risk of unauthorized script execution within the context of the user session.

This vulnerability is identified as a cross-site scripting (CWE-79) flaw. It allows a low-privileged, authenticated attacker to inject malicious scripts into the web interface, which are then executed when viewed by other users.

The vulnerability carries a CVSS score of 8.7, indicating high severity. Successful exploitation could lead to session hijacking, unauthorized actions performed on behalf of legitimate users, or the theft of sensitive information handled within the lakeFS repository management interface.

Immediate Action: Upgrade lakeFS to version 1.81.1 or later, or lakeFS-enterprise to version 1.84.0 or later, as provided by the vendor.

Proactive Monitoring: Review access logs for unusual patterns in requests to the web user interface and monitor for anomalous JavaScript execution within browser environments.

Compensating Controls: Implement a strict Content Security Policy (CSP) to restrict the sources from which scripts can be loaded and executed.

Public Exploit Available: No

Given the potential for unauthorized access and session manipulation, administrators should prioritize updating their lakeFS instances. Applying the vendor-supplied patches is the only reliable way to neutralize this cross-site scripting risk.