Skip to content
OpenAdvisories
High RHSA-2026:58500 8 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Published Aug 23, 2026 · Updated Oct 20, 2026

Ecosystem: Red Hat

Fixed packages 1

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 grafana12.4 0:12.4.8-0.1.2.hum1

Vulnerabilities 8

  • High 7.2
    CVE-2026-65898

    DOMPurify before 3.4.11 Permanent Attribute Allowlist Pollution via setConfig

    DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute hook, allowing the hook to permanently mutate the shared allowlist. Attackers can register a hook that conditionally allows dangerous attr…

    cure53 DOMPurify langfuse-3-worker nextcloud-server-33 Debian Ubuntu Wolfi npm
  • Medium 6.1
    CVE-2026-65899

    DOMPurify before 3.4.9 Trusted Types Policy State Contamination

    DOMPurify 3.0.0 before 3.4.9 does not reset the retained Trusted Types policy when clearConfig() is called, so a DOMPurify instance reused across trust boundaries stays bound to a previously supplied TRUSTED_TYPES_POLICY. A later caller that requests RETURN_T…

    cure53 DOMPurify langfuse-3-worker opensearch-dashboards-3 Debian Ubuntu Wolfi npm
  • Medium 6.1
    CVE-2026-65901

    DOMPurify 3.4.6 Cross-Site Scripting via IN_PLACE nodeName

    DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in IN_PLACE mode that trusts attacker-controlled nodeName on live non-form nodes. Attackers can supply hostile live DOM objects with real script children whose observable nodeName is clobbe…

    cure53 DOMPurify langfuse-3-worker nextcloud-server-33 Debian Ubuntu Wolfi npm
  • Medium 6.1
    CVE-2026-65902

    DOMPurify before 3.4.7 Hook Mutation Pollution via allowedTags

    DOMPurify before 3.4.7 passes direct references to the module-level DEFAULT_ALLOWED_TAGS and DEFAULT_ALLOWED_ATTR sets to the uponSanitizeElement and uponSanitizeAttribute hooks via data.allowedTags / data.allowedAttributes when sanitize is called without an …

    cure53 DOMPurify langfuse-3-worker nextcloud-server-33 Debian Ubuntu Wolfi npm
  • Medium 6.1
    CVE-2026-65911

    DOMPurify before 3.4.0 XSS via ADD_ATTR/ADD_TAGS State Leakage

    In DOMPurify through 3.3.3, function predicates supplied via ADD_ATTR or ADD_TAGS to DOMPurify.sanitize() persist in internal state (EXTRA_ELEMENT_HANDLING) across subsequent sanitize() calls on the same instance. If a later call on the same instance provides…

    cure53 DOMPurify node-dompurify node-dompurify Debian Ubuntu
  • Medium 6.1
    CVE-2026-65912

    DOMPurify before 3.3.2 URI Validation Bypass via ADD_ATTR

    DOMPurify before 3.3.2 contains a URI validation bypass vulnerability when ADD_ATTR is provided as a predicate function via EXTRA_ELEMENT_HANDLING.attributeCheck. Attackers can supply a predicate that accepts specific attribute and tag combinations to bypass …

    cure53 DOMPurify dompurify node-dompurify Debian Ubuntu npm
  • Medium 6.1
    CVE-2026-65913

    DOMPurify before 3.3.2 Prototype Pollution via USE_PROFILES

    DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USE_PROFILES mode that allows attackers to bypass attribute filtering by polluting Array.prototype properties. Attackers can set Array.prototype properties like onclick to true, causing DO…

    cure53 DOMPurify dompurify node-dompurify Debian Ubuntu npm
  • Medium 5.3
    CVE-2026-65914

    DOMPurify before 3.3.2 Mutation XSS via Re-Contextualization

    DOMPurify before 3.3.2 contains a mutation-XSS vulnerability when sanitized HTML is reinserted into special parsing contexts using innerHTML with wrappers like script, xmp, iframe, noembed, noframes, or noscript. Attackers can craft payloads with closing sequ…

    cure53 DOMPurify dompurify node-dompurify Debian Ubuntu npm

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-65898
  • report
    https://access.redhat.com/security/cve/CVE-2026-65899
  • report
    https://access.redhat.com/security/cve/CVE-2026-65901
  • report
    https://access.redhat.com/security/cve/CVE-2026-65902
  • report
    https://access.redhat.com/security/cve/CVE-2026-65911
  • report
    https://access.redhat.com/security/cve/CVE-2026-65912
  • report
    https://access.redhat.com/security/cve/CVE-2026-65913
  • report
    https://access.redhat.com/security/cve/CVE-2026-65914
  • article
    https://access.redhat.com/security/updates/classification/
  • article
    https://images.redhat.com/
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_58500.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2506436
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-65898
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-65898
  • article
    https://github.com/cure53/DOMPurify/security/advisories/GHSA-cmwh-pvxp-8882
  • article
    https://www.vulncheck.com/advisories/dompurify-before-permanent-attribute-allowlist-pollution-via-setconfig
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2506428
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-65899
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-65899
  • article
    https://github.com/cure53/DOMPurify/commit/825e617753ac1169306a542d3174a77f717a0cf6
  • article
    https://github.com/cure53/DOMPurify/security/advisories/GHSA-vxr8-fq34-vvx9
  • article
    https://www.vulncheck.com/advisories/dompurify-before-trusted-types-policy-state-contamination
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2506432
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-65901
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-65901
  • article
    https://github.com/cure53/DOMPurify/security/advisories/GHSA-x4vx-rjvf-j5p4
  • article
    https://www.vulncheck.com/advisories/dompurify-cross-site-scripting-via-in-place-nodename
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2506431
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-65902
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-65902
  • article
    https://github.com/cure53/DOMPurify/commit/7996f1dc78eb8b7922388aed75d94a9f8fad9a36
  • article
    https://github.com/cure53/DOMPurify/security/advisories/GHSA-76mc-f452-cxcm
  • article
    https://www.vulncheck.com/advisories/dompurify-before-hook-mutation-pollution-via-allowedtags
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2506434
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-65911
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-65911
  • article
    https://github.com/cure53/DOMPurify/security/advisories/GHSA-9p3w-6h5p-cv75
  • article
    https://www.vulncheck.com/advisories/dompurify-before-xss-via-add-attr-add-tags-state-leakage
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2506427