Skip to content
OpenAdvisories
High RHSA-2026:58502 4 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published Aug 25, 2026 · Updated Oct 20, 2026

Ecosystem: Red Hat

Fixed packages 1

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 grafana13.1 0:13.1.3-0.1.3.hum1

Vulnerabilities 4

  • High 7.2
    CVE-2026-65898

    DOMPurify before 3.4.11 Permanent Attribute Allowlist Pollution via setConfig

    DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute hook, allowing the hook to permanently mutate the shared allowlist. Attackers can register a hook that conditionally allows dangerous attr…

    cure53 DOMPurify langfuse-3-worker nextcloud-server-33 Debian Ubuntu Wolfi npm
  • Medium 6.1
    CVE-2026-65899

    DOMPurify before 3.4.9 Trusted Types Policy State Contamination

    DOMPurify 3.0.0 before 3.4.9 does not reset the retained Trusted Types policy when clearConfig() is called, so a DOMPurify instance reused across trust boundaries stays bound to a previously supplied TRUSTED_TYPES_POLICY. A later caller that requests RETURN_T…

    cure53 DOMPurify langfuse-3-worker opensearch-dashboards-3 Debian Ubuntu Wolfi npm
  • Medium 6.1
    CVE-2026-65901

    DOMPurify 3.4.6 Cross-Site Scripting via IN_PLACE nodeName

    DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in IN_PLACE mode that trusts attacker-controlled nodeName on live non-form nodes. Attackers can supply hostile live DOM objects with real script children whose observable nodeName is clobbe…

    cure53 DOMPurify langfuse-3-worker nextcloud-server-33 Debian Ubuntu Wolfi npm
  • Medium 6.1
    CVE-2026-65902

    DOMPurify before 3.4.7 Hook Mutation Pollution via allowedTags

    DOMPurify before 3.4.7 passes direct references to the module-level DEFAULT_ALLOWED_TAGS and DEFAULT_ALLOWED_ATTR sets to the uponSanitizeElement and uponSanitizeAttribute hooks via data.allowedTags / data.allowedAttributes when sanitize is called without an …

    cure53 DOMPurify langfuse-3-worker nextcloud-server-33 Debian Ubuntu Wolfi npm

References

  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2026-65902
  • article
    https://access.redhat.com/security/updates/classification/
  • report
    https://access.redhat.com/security/cve/CVE-2026-65898
  • report
    https://access.redhat.com/security/cve/CVE-2026-65899
  • report
    https://access.redhat.com/security/cve/CVE-2026-65901
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_58502.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2506436
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-65898
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-65898
  • article
    https://github.com/cure53/DOMPurify/security/advisories/GHSA-cmwh-pvxp-8882
  • article
    https://www.vulncheck.com/advisories/dompurify-before-permanent-attribute-allowlist-pollution-via-setconfig
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2506428
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-65899
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-65899
  • article
    https://github.com/cure53/DOMPurify/commit/825e617753ac1169306a542d3174a77f717a0cf6
  • article
    https://github.com/cure53/DOMPurify/security/advisories/GHSA-vxr8-fq34-vvx9
  • article
    https://www.vulncheck.com/advisories/dompurify-before-trusted-types-policy-state-contamination
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2506432
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-65901
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-65901
  • article
    https://github.com/cure53/DOMPurify/security/advisories/GHSA-x4vx-rjvf-j5p4
  • article
    https://www.vulncheck.com/advisories/dompurify-cross-site-scripting-via-in-place-nodename
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2506431
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-65902
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-65902
  • article
    https://github.com/cure53/DOMPurify/commit/7996f1dc78eb8b7922388aed75d94a9f8fad9a36
  • article
    https://github.com/cure53/DOMPurify/security/advisories/GHSA-76mc-f452-cxcm
  • article
    https://www.vulncheck.com/advisories/dompurify-before-hook-mutation-pollution-via-allowedtags