What’s Vulnerable › Vulnerabilities

CVE-2024-42351: Possible Data Tampering & Loss of Public Datasets in Galaxy

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-09-20 · updated 2026-06-17
• Weakness: CWE-200

Description

Galaxy is a free, open-source system for analyzing data, authoring workflows, training and education, publishing tools, managing infrastructure, and more. An attacker can potentially replace the contents of public datasets resulting in data loss or tampering. All supported branches of Galaxy (and more back to release_21.05) were amended with the below patch. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected products

• galaxyproject galaxy: before 21.05 — fixed in 21.05

How to fix

Upgrade to a fixed version: galaxyproject galaxy 21.05. Check the vendor advisory for mitigations.

References

• https://depot.galaxyproject.org/patch/GX-2024-0001/022da344a02bafd604402ac8e253e0014f6e2e08.patch
• https://depot.galaxyproject.org/patch/GX-2024-0001/15060a6cb222f2fcfc687d0f0260f1eb1b9c757b.patch
• https://depot.galaxyproject.org/patch/GX-2024-0001/235f1d8b400708556732b9dda788c919ebf3bb80.patch
• https://github.com/galaxyproject/galaxy/security/advisories/GHSA-5639-cmph-9j4v

Get alerted when CVE-2024-42351 or the next vulnerability affects your stack