VDB
RHSA-2025:19003
RHSA-2025:19003
PUBLISHED
CVSS 8.199999809265137 HIGH
A prototype pollution vulnerability was found in DOMPurify. This flaw allows a remote attacker to add or modify attributes of an object prototype. This issue can lead to the injection of malicious attributes used in other components or cause a crash by overriding existing attributes with ones of incompatible type.
Risk Scores
CVSS 3.1
8.199999809265137
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/openshift4/azure-service-rhel9-operator@sha256:ad4cbc844c1049b56def008f0c20ec2e70611a41cab762de159123eabca52bc7_amd64 as a component of Red Hat OpenShift Container Platform 4.20 | * |
| Red Hat | registry.redhat.io/openshift4/ose-azure-cloud-controller-manager-rhel9@sha256:eaee5c96aa11e868f4ef21e7024aeea46d74a0c28296d54ad54b38f32a544dcb_amd64 as a component of Red Hat OpenShift Container Platform 4.20 | * |
| Red Hat | registry.redhat.io/openshift4/ovirt-csi-driver-rhel9@sha256:07f75fe65ee24835d18df82cb11c2bd28424837e0bea3f9534a4ebd40706c409_amd64 as a component of Red Hat OpenShift Container Platform 4.2 | * |
| Red Hat | registry.redhat.io/openshift4/ose-machine-api-provider-openstack-rhel9@sha256:66b86f0d17e19dd11db3f4ae27a60a464873a699331c475ed0b67e99df3ba6c5_s390x as a component of Red Hat OpenShift Container Platform 4.20 | * |
| Red Hat | registry.redhat.io/openshift4/ose-azure-cloud-controller-manager-rhel9@sha256:9ab831c9006d1bbbaa1853069f3babace6f231861bf6a34f6f735a7e38175da8_arm64 as a component of Red Hat OpenShift Container Platform 4.20 | * |
| Red Hat | registry.redhat.io/openshift4/ose-operator-registry-rhel9@sha256:16cce2a483ba67b6dddae890e140ce6bc7db47d4c046848f92fcd6cfc9af083d_arm64 as a component of Red Hat OpenShift Container Platform 4.20 | * |
| Red Hat | registry.redhat.io/openshift4/ose-insights-rhel9-operator@sha256:c42bf88b3400852ff88abfdc5d479377c5b4a53e4dea3ddde97b70f432cd3f73_amd64 as a component of Red Hat OpenShift Container Platform 4.2 | * |
| Red Hat | registry.redhat.io/openshift4/frr-rhel9@sha256:6a974f04d4aefdb39bf2d4649b24e7e0e87685afa3d07ca46234f1a0c5688e4b_amd64 as a component of Red Hat OpenShift Container Platform 4.20 | * |
| Red Hat | registry.redhat.io/openshift4/ose-csi-driver-nfs-rhel9@sha256:76e26b7577d6b4f000e49a5dcce1cb771ec21aacf462954dc8a14db8ffcf8ebe_amd64 as a component of Red Hat OpenShift Container Platform 4.20 | * |
| Red Hat | registry.redhat.io/openshift4/ose-hypershift-rhel9@sha256:574cacb49c46d87ff5727f890b96bf7074b573de62933c953d287e3b96d9b953_amd64 as a component of Red Hat OpenShift Container Platform 4.2 | * |
| Red Hat | registry.redhat.io/openshift4/ose-machine-config-rhel9-operator@sha256:34ede7d92613ad38be71dfb4eb3fad4d18c626071903e0ccf5678068d2d68e9c_ppc64le as a component of Red Hat OpenShift Container Platform 4.2 | * |
| Red Hat | registry.redhat.io/openshift4/ose-powervs-cloud-controller-manager-rhel9@sha256:7ed5fcae6e28a40fd164ef52f8f1f35d59a3addfe13b6faa7f43a0067877e0c3_amd64 as a component of Red Hat OpenShift Container Platform 4.2 | * |
| Red Hat | registry.redhat.io/openshift4/ose-kubevirt-cloud-controller-manager-rhel9@sha256:e383f6f212d8bdbda7d50637e162ef06d356e2846dbf92bd938f29a3c12ffd37_arm64 as a component of Red Hat OpenShift Container Platform 4.2 | * |
| Red Hat | registry.redhat.io/openshift4/ose-machine-api-provider-azure-rhel9@sha256:61441efe11980a9f7b09f0adf7a33319306ad9c8c03da5b45b0e87afe339a03a_arm64 as a component of Red Hat OpenShift Container Platform 4.2 | * |
| Red Hat | registry.redhat.io/openshift4/ose-openstack-cluster-api-controllers-rhel9@sha256:7ddd918d46643aa4efedbd6a497bc3d191c84d5afb39fc850a86cef10871323a_arm64 as a component of Red Hat OpenShift Container Platform 4.20 | * |
| Red Hat | registry.redhat.io/openshift4/ose-multus-admission-controller-rhel9@sha256:cb098c14a3739363938b0d56ddc1ff6a457bf7f518a71d289e9fd3204a06b19e_arm64 as a component of Red Hat OpenShift Container Platform 4.2 | * |
| Red Hat | registry.redhat.io/openshift4/ose-installer-artifacts-rhel9@sha256:1d78c6604cb53041eb9dc33cb79ad6d21c4d2179235cc1ec78699a7a23370c88_s390x as a component of Red Hat OpenShift Container Platform 4.2 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-kube-cluster-api-rhel9-operator@sha256:c03e7010e068a83665e0f983d8d3a8cc788878e78b5b06518588d095fba999e3_s390x as a component of Red Hat OpenShift Container Platform 4.2 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-authentication-rhel9-operator@sha256:fd98e056fbe04b49fd19876bb303e0858571026591bd76d5362c3088a1f44e63_arm64 as a component of Red Hat OpenShift Container Platform 4.20 | * |
| Red Hat | registry.redhat.io/openshift4/ose-kube-state-metrics-rhel9@sha256:cf84844a02fa9fc8ce523d2bf5c911119391ac2ad8b9c202d89ea1cd8e59a280_amd64 as a component of Red Hat OpenShift Container Platform 4.2 | * |
…and 1312 more
Timeline
- Oct 30, 2025 CVE Published
- Aug 6, 2026 CVE Updated
- Aug 6, 2026 Distribution Patch
- Aug 6, 2026 Distribution Patch
- Aug 6, 2026 Security Advisory
- Aug 6, 2026 Security Advisory
- Aug 6, 2026 Security Advisory
References
- https://access.redhat.com/security/updates/classification/ advisory
- https://github.com/cure53/DOMPurify/commit/d1dd0374caef2b4c56c3bd09fe1988c3479166dc advisory
- https://github.com/cure53/DOMPurify/security/advisories/GHSA-p3vf-v8qc-cwcr advisory
- https://go.dev/cl/670375 advisory
- https://go.dev/issue/73612 advisory
- https://groups.google.com/g/golang-announce/c/ufZ8WpEsA3A advisory
- https://access.redhat.com/errata/RHSA-2025:19003 advisory
- https://access.redhat.com/security/cve/CVE-2024-48910 advisory
- https://access.redhat.com/security/cve/CVE-2025-22874 advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_19003.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2322949 issue
- https://www.cve.org/CVERecord?id=CVE-2024-48910 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-48910 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2372320 issue
- https://www.cve.org/CVERecord?id=CVE-2025-22874 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-22874 advisory
- https://pkg.go.dev/vuln/GO-2025-3749 advisory