CVE-2026-103871
Description
A flaw was found in pulp-python's PyPI simple index. Project names are written into the HTML index without escaping. A user who can publish a Python package can store markup in the package name. A person who opens that index in a browser runs the markup in the origin that served the page, and the attacker or user can take limited actions as that person on that site during the visit. The flaw does not run commands on the server.
Statement
This vulnerability is rated as Moderate by Red Hat Product Security. This vulnerability affects pulp-python's HTML simple index.
The attacker needs an account allowed to publish Python packages. Someone has to open the HTML page. After publication the index is readable without authentication. No extra setting is required on a pulp-python server that serves the simple API. The detail page is escaped, and a client that asks for the JSON index does not render this template.
Confidentiality and integrity of that browsing session are limited to actions on the origin while the page is open. Availability is not affected. The user API cannot create a superuser from this page. That limited session impact, and the need for someone to open the page, hence, treated as Moderate.
The unescaped index code was added in pulp-python 3.0.0b1 in upstream
Red Hat products do not ship pulp-python server, which contains the affected code.
Satellite 6.16, 6.17, 6.18, and 6.19 ship rubygem-pulp_python_client only. That package is the Ruby API client. It does not generate the simple index, hence, it is not-affected.
Mitigation
Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security's standards for usability, deployment, applicability, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.4 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | Required | N/A | N/A |
| Scope | Changed | N/A | N/A |
| Confidentiality | Low | N/A | N/A |
| Integrity Impact | Low | N/A | N/A |
| Availability Impact | None | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Acknowledgements
Red Hat would like to thank gwolfs (Independent Security Researcher) for reporting this issue.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
