CVE-2024-42346: Galaxyproject Galaxy

Medium severity, CVSS 5.4. EPSS: 0.8% chance of exploitation in the next 30 days.

Galaxy is a free, open-source system for analyzing data, authoring workflows, training and education, publishing tools, managing infrastructure, and more. The editor visualization, /visualizations endpoint, can be used to store HTML tags and trigger javascript execution upon edit operation. All supported branches of Galaxy (and more back to release_20.05) were amended with the supplied patches. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected products

• Galaxyproject Galaxy: before 24.1.1 (fixed in 24.1.1)

Published 2024-09-20. Last modified 2026-06-17.