conda-forge.github.io vulnerabilities

Latest conda-forge.github.io CVEs

Newest publication first

1. CVE-2026-55422 conda-forge.org: Stored DOM XSS via unsanitized dangerouslySetInnerHTML in the status dashboard

   Published 2026-10-23

   Medium·CVSS 4.6 EPSS 0.16%

   conda-forge is a GitHub organization containing repositories of conda recipes. In commits 85748ad2368a and prior, two React components render externally-sourced strings directly as HTML using dangerouslySetInnerHTML, with no sanitization (the project has no DOMPurify or equivalen...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.