title: Stored cross site scripting
description: A flaw was found in the Quay registry. While the image labels created through Quay undergo validation both in the UI and backend by applying a regex (validation.py), the same validation is
not performed when the label comes from an image. This flaw allows an attacker to publish a malicious image to a public registry containing a script that can be executed via Cross-site scripting (XSS).
problem types: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
affected:
{
product: quay-registry-container
vendor: n/a
defaultStatus: affected
}
{
vendor: Red Hat
product: Red Hat Quay 3
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: quay/quay-rhel8
defaultStatus: affected
cpes: cpe:/a:redhat:quay:3
}
metrics:
other: [
content: {'value': 'Moderate', 'namespace': 'https://access.redhat.com/security/updates/classification/'}
type: Red Hat severity rating
]