VDB
GHSA-mrv2-3pqr-j5jr
GHSA-mrv2-3pqr-j5jr
PUBLISHED
CVSS 6.800000190734863 MEDIUM
DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p)
Risk Scores
CVSS 3.1
6.800000190734863
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| chainguard | opensearch-dashboards-2-fips | 0 |
| chainguard | nextcloud-server-34 | 0 |
| chainguard | opensearch-dashboards-2 | 0 |
| npm | dompurify | 0 |
| chainguard | nextcloud-server-35 | 0 |
Timeline
- Oct 22, 2026 CVE Published
References
- https://github.com/advisories/GHSA-mrv2-3pqr-j5jr advisory
- https://github.com/cure53/DOMPurify/security/advisories/GHSA-mrv2-3pqr-j5jr url
- https://github.com/cure53/DOMPurify/pull/1672 patch
- https://github.com/cure53/DOMPurify/commit/a77a3e78b59f72fa4d1c83f22e121ad9cc7d3575 patch
- https://github.com/cure53/DOMPurify/releases/tag/3.4.17 url