CVE-2026-103871

{}

{}

{}

{"acknowledgement": "Red Hat would like to thank Daoqing Yu for reporting this issue.", "bugzilla": {"description": "pulp_python: Simple index renders project names without HTML escaping", "id": "2544611", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2544611"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-79", "details": ["A flaw was found in pulp-python's PyPI simple index. Project names are written into the HTML index without escaping. A user who can publish a Python package can store markup in the package name. A person who opens that index in a browser runs the markup in the origin that served the page, and the attacker or user can take limited actions as that person on that site during the visit. The flaw does not run commands on the server."], "mitigation": {"lang": "en:us", "value": "Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security's standards for usability, deployment, applicability, or stability."}, "name": "CVE-2026-103871", "package_state": [{"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Not affected", "package_name": "rubygem-pulp_python_client", "product_name": "Red Hat Satellite 6"}], "public_date": "2026-10-07T05:34:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-103871\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-103871"], "statement": "This vulnerability is rated as Moderate by Red Hat Product Security. This vulnerability affects pulp-python's HTML simple index.\nThe attacker needs an account allowed to publish Python packages. Someone has to open the HTML page. After publication the index is readable without authentication. No extra setting is required on a pulp-python server that serves the simple API. The detail page is escaped, and a client that asks for the JSON index does not render this template.\nConfidentiality and integrity of that browsing session are limited to actions on the origin while the page is open. Availability is not affected. The user API cannot create a superuser from this page. That limited session impact, and the need for someone to open the page, hence, treated as Moderate.\n```\nThe unescaped index code was added in pulp-python 3.0.0b1 in upstream\n```\n```\nRed Hat products do not ship pulp-python server, which contains the affected code. \nSatellite 6.16, 6.17, 6.18, and 6.19 ship rubygem-pulp_python_client only. That package is the Ruby API client. It does not generate the simple index, hence, it is not-affected.\n```", "threat_severity": "Moderate"}

{"created": "2026-10-07T13:30:17.041236+00:00", "updated": "2026-10-07T13:30:17.041251+00:00", "vendors": []}