VDB
GHSA-55q2-fjhq-7xh7
GHSA-55q2-fjhq-7xh7
PUBLISHED
CVSS 4.599999904632568 MEDIUM
DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSS
Risk Scores
CVSS 3.1
4.599999904632568
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| npm | dompurify | |
| wolfi | langfuse-3 | 0, 0 |
| chainguard | gitlab-rails-ce-fips-19.3 | 0 |
| chainguard | awx | 0 |
| chainguard | langfuse-fips-3 | 0 |
| chainguard | gitlab-rails-ce-fips-19.2 | 0 |
| npm | dompurify | 0 |
| chainguard | librechat | 0 |
| chainguard | gitlab-rails-ce-19.3 | 0 |
| chainguard | nextcloud-server-33 | 0 |
| chainguard | gitlab-rails-ce-19.2 | 0 |
| chainguard | opensearch-dashboards-2-fips | 0 |
| chainguard | tensorflow-gpu-jupyter | 0 |
| chainguard | wazuh-dashboard-fips | 0 |
| chainguard | wazuh-dashboard | 0 |
| chainguard | gitlab-rails-ce-19.1 | 0 |
| wolfi | nextcloud-server-33 | 0 |
| wolfi | nextcloud-server-32 | 0 |
| chainguard | nextcloud-server-32 | 0 |
| chainguard | nextcloud-server-34 | 0 |
…and 7 more
Timeline
- Aug 7, 2026 CVE Published
References
- https://github.com/advisories/GHSA-55q2-fjhq-7xh7 advisory
- https://github.com/cure53/DOMPurify/security/advisories/GHSA-55q2-fjhq-7xh7 url
- https://github.com/cure53/DOMPurify/pull/1557 patch
- https://github.com/cure53/DOMPurify/commit/3067f7746769 patch
- https://github.com/cure53/DOMPurify/releases/tag/3.4.13 url