Bug 2544611 (CVE-2026-103871)

Summary:	CVE-2026-103871 pulp_python: Simple index renders project names without HTML escaping
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	anthomas, ehelms, ggainey, jpasqual, juwatts, mdellweg, mhulan, nmoumoul, osousa, pcreech, rchan, security-response-team, smallamp, tmalecek
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in pulp-python's PyPI simple index. Project names are written into the HTML index without escaping. A user who can publish a Python package can store markup in the package name. A person who opens that index in a browser runs the markup in the origin that served the page, and the attacker or user can take limited actions as that person on that site during the visit. The flaw does not run commands on the server.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-01 12:56:03 UTC

write_simple_index() builds simple_index_template with Jinja2 Template() and does not enable autoescape, then inserts the project name (pulp_python/app/utils.py). write_simple_detail() in the same file passes autoescape=True. The name is taken from package metadata with no character allow-list (parse_project_metadata). SimpleView list and retrieve allow principal *. Browsers get the HTML renderer by default. Upload requires an authenticated user with python.modify_pythonrepository. A viewer of that HTML runs the markup in the origin that served the index. This does not by itself run operating-system commands. The template was added in 3fd41a55, first tag 3.0.0b1.

Red Hat does not ship the pulp-python server. Satellite 6.16, 6.17, 6.18, and 6.19 ship rubygem-pulp_python_client only. That package is the Ruby API client. It does not generate the simple index.