VDB
GHSA-cg2g-xh64-v4q7
GHSA-cg2g-xh64-v4q7
PUBLISHED
CVSS 7.699999809265137 HIGH
DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes
Risk Scores
CVSS 3.1
7.699999809265137
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| chainguard | wazuh-dashboard | 0 |
| npm | dompurify | 3.4.4 |
| chainguard | nextcloud-server-35 | 0 |
| npm | dompurify | |
| chainguard | nextcloud-server-34 | 0 |
| chainguard | supabase | 0 |
| chainguard | opensearch-dashboards-2-fips | 0 |
| chainguard | wazuh-dashboard-fips | 0 |
| chainguard | awx | 0 |
| chainguard | opensearch-dashboards-2 | 0 |
Timeline
- Oct 22, 2026 CVE Published
References
- https://github.com/advisories/GHSA-cg2g-xh64-v4q7 advisory
- https://github.com/cure53/DOMPurify/security/advisories/GHSA-cg2g-xh64-v4q7 url
- https://github.com/cure53/DOMPurify/pull/1672 patch
- https://github.com/cure53/DOMPurify/commit/a77a3e78b59f72fa4d1c83f22e121ad9cc7d3575 patch
- https://github.com/cure53/DOMPurify/releases/tag/3.4.17 url