x/vulndb: potential Go vuln in github.com/treeverse/lakefs: GHSA-9phh-r37v-34wh

[GoVulnBot]

In GitHub Security Advisory GHSA-9phh-r37v-34wh, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
github.com/treeverse/lakefs	0.106.0	< 0.106.0

Cross references:

• Module github.com/treeverse/lakefs appears in issue x/vulndb: potential Go vuln in github.com/treeverse/lakefs: GHSA-m836-gxwq-j2pm #375 EFFECTIVELY_PRIVATE
• Module github.com/treeverse/lakefs appears in issue x/vulndb: potential Go vuln in github.com/treeverse/lakefs: GHSA-28q9-9c3g-v3f9 #1019 EFFECTIVELY_PRIVATE

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/treeverse/lakefs
      versions:
        - fixed: 0.106.0
      vulnerable_at: 0.105.0
      packages:
        - package: github.com/treeverse/lakefs
summary: |-
    lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML
    Files
description: |-
    ### Impact The browser renders the resulting HTML when opening a direct link to
    an HTML file via lakeFS. Any JavaScript within that page is executed within the
    context of the domain lakeFS is running in. An attacker can inject a malicious
    script inline, download resources from another domain, or make arbitrary HTTP
    requests. This would allow the attacker to send information to a random domain
    or carry out lakeFS operations while impersonating the victim.

    Note that to carry out this attack, an attacker must already have access to
    upload the malicious HTML file to one or more repositories. It also depends on
    the victim receiving and opening the link to the malicious HTML file.

    ### Patches This is fixed in lakeFS version 0.106.0

    ### Workarounds There are no known workarounds at this time.
ghsas:
    - GHSA-9phh-r37v-34wh
references:
    - advisory: https://github.com/treeverse/lakeFS/security/advisories/GHSA-9phh-r37v-34wh
    - fix: https://github.com/treeverse/lakeFS/commit/2b2a9fa156ad80b0aac043e17533b546b1800603
    - web: https://github.com/treeverse/lakeFS/releases/tag/v0.106.0
    - advisory: https://github.com/advisories/GHSA-9phh-r37v-34wh

[gopherbot]

Change https://go.dev/cl/522555 mentions this issue: data/excluded: batch add 11 excluded reports

[gopherbot]

Change https://go.dev/cl/592762 mentions this issue: data/reports: unexclude 75 reports

[gopherbot]

Change https://go.dev/cl/606790 mentions this issue: data/reports: unexclude 20 reports (10)