CVE-2024-42346

HIGH

Galaxy < 24.1.1 - Stored Cross-Site Scripting via Visualization Editor

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2024-42346. PoCs published by partywavesec.

AI-analyzed exploit summary The repository contains no exploit code or technical details, only a link to a video and an external website. This is characteristic of a social engineering lure.

Description

Galaxy is a free, open-source system for analyzing data, authoring workflows, training and education, publishing tools, managing infrastructure, and more. The editor visualization, /visualizations endpoint, can be used to store HTML tags and trigger javascript execution upon edit operation. All supported branches of Galaxy (and more back to release_20.05) were amended with the supplied patches. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Exploits (1)

nomisec SUSPICIOUS 1 stars
by partywavesec · poc
https://github.com/partywavesec/CVE-2024-42346

The repository contains no exploit code or technical details, only a link to a video and an external website. This is characteristic of a social engineering lure.

Classification
Suspicious 90%
Attack Type
Other
Complexity
Theoretical
Reliability
Theoretical
Target: unknown
No auth needed
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (1)

Core 1
Core References

Scores

CVSS v3 7.6
EPSS 0.0070
EPSS Percentile 48.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (1)
galaxyproject/galaxy < 24.1.1
Published Sep 20, 2024
Tracked Since Feb 18, 2026