VDB
RHSA-2026:49680
RHSA-2026:49680
PUBLISHED
CVSS 7.5 HIGH
A flaw was found in DOMPurify, a tool designed to sanitize HTML, MathML, and SVG to prevent cross-site scripting (XSS) attacks. When performing in-place sanitization, DOMPurify could fail to properly process content within shadow DOM elements attached to a <template>.content. This oversight allows an attacker to embed malicious code, such as JavaScript, which could then execute when the sanitized template is used by an application, potentially leading to unauthorized actions or information disclosure.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:91c72b08312e6cfe597e9e111d6a2b7d5f433f8af6e5f66a335f5ffdf60f789d_s390x as a component of Red Hat OpenShift Service Mesh 3.3 | * |
| Red Hat | registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:3e8e9ef6e034abcbcf92a85f5e8e918f9a34f3df743259eb4f61918321ad16f3_amd64 as a component of Red Hat OpenShift Service Mesh 3.3 | * |
| Red Hat | registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:a9893771653783a12a8603eecc5c981617e55ae01fd6d064880b5b86f08cb823_ppc64le as a component of Red Hat OpenShift Service Mesh 3.3 | * |
| Red Hat | registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:0f51052c03d6eaab0b26601649e73846ca9b97439079fe8d25fbe64b694a58d4_arm64 as a component of Red Hat OpenShift Service Mesh 3.3 | * |
| Red Hat | registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:7ffec264b9fdeb23d8d7c62b69e36369e34f46e1b4fb506a6946316790113234_arm64 as a component of Red Hat OpenShift Service Mesh 3.3 | * |
| Red Hat | registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:0afd0142183f5b43b618e3db4fc16efd5fd6c5db688ad7eb22ec7a315247bf92_s390x as a component of Red Hat OpenShift Service Mesh 3.3 | * |
| Red Hat | registry.redhat.io/openshift-service-mesh/kiali-rhel9@sha256:62c9b369b8246774dabe497aa6c884ee97ac6fb53a6ac4324f21fbc02a243ff0_amd64 as a component of Red Hat OpenShift Service Mesh 3.3 | * |
| Red Hat | registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9@sha256:66eb06b628f7457fbb95e2f488de438837c6a9a69c62cb54bc3068583aa8344d_ppc64le as a component of Red Hat OpenShift Service Mesh 3.3 | * |
Timeline
- Aug 3, 2026 CVE Published
- Aug 25, 2026 CVE Updated
- Aug 25, 2026 Distribution Patch
- Aug 25, 2026 Distribution Patch
- Aug 25, 2026 Security Advisory
- Aug 25, 2026 Security Advisory
- Aug 25, 2026 Security Advisory
- Aug 25, 2026 Security Advisory
- Aug 25, 2026 Security Advisory
- Aug 25, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:49680 advisory
- https://access.redhat.com/security/cve/CVE-2026-49978 advisory
- https://access.redhat.com/security/cve/CVE-2026-59869 advisory
- https://access.redhat.com/security/cve/CVE-2026-59873 advisory
- https://access.redhat.com/security/cve/CVE-2026-59874 advisory
- https://access.redhat.com/security/cve/CVE-2026-59877 advisory
- https://access.redhat.com/security/updates/classification advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_49680.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2500695 issue
- https://www.cve.org/CVERecord?id=CVE-2026-49978 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-49978 advisory
- https://github.com/cure53/DOMPurify/commit/ca30f070c360df162a3e3848e80e6fd3c9e74bff advisory
- https://github.com/cure53/DOMPurify/releases/tag/3.4.7 advisory
- https://github.com/cure53/DOMPurify/security/advisories/GHSA-rp9w-3fw7-7cwq advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2498122 issue
- https://www.cve.org/CVERecord?id=CVE-2026-59869 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-59869 advisory
- https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7 advisory
- https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4 advisory
…and 24 more