CVE-2026-48026

lakeFS contains a stored XSS in the Web UI Markdown renderer. Before versions 1.81.1 (OSS) and 1.84.0 (Enterprise), rendering README/markdown objects without HTML sanitization lets a user with write access commit a .md file containing arbitrary HTML/JavaScript; any user opening it in an authentic...