Bug 2549763 (CVE-2026-109345)
| Summary: | CVE-2026-109345 dompurify: DOMPurify: Cross-site scripting via unsanitized raw text in in-place mode | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | Keywords: | Security |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in DOMPurify. This vulnerability allows a remote attacker to conduct cross-site scripting (XSS) attacks by bypassing HTML sanitization when the library operates in in-place mode. When processing raw text elements containing embedded markup, the library removes the element but fails to neutralize its text content before returning the node. If the application subsequently serializes and re-parses the returned content, the embedded script executes within the user's browser session.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
OSIDB Bzimport
2026-10-12 16:44:47 UTC
|