Read the docs
Red Hat Security Advisory

RHSA-2026:58502

Red Hat Hardened Images RPMs bug fix and enhancement update

Released 2026-08-22 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Fixes 4 records

TI-2026-46942 CVE-2026-65902 · GHSA-76mc-f452-cxcm

DOMPurify before 3.4.7 Hook Mutation Pollution via allowedTags

Priority MEDIUM 57

DOMPurify before 3.4.7 passes direct references to the module-level DEFAULT_ALLOWED_TAGS and DEFAULT_ALLOWED_ATTR sets to the uponSanitizeElement and uponSanitizeAttribute hooks via data.allowedTags / data.allowedAttribu…

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00355 Published 2026-07-23 Partial fix · 3.4.7 CWE-501
TI-2026-46941 CVE-2026-65901 · GHSA-x4vx-rjvf-j5p4

DOMPurify 3.4.6 Cross-Site Scripting via IN_PLACE nodeName

Priority MEDIUM 56

DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in IN_PLACE mode that trusts attacker-controlled nodeName on live non-form nodes.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00285 Published 2026-07-23 Partial fix CWE-79
TI-2026-46939 CVE-2026-65899 · GHSA-vxr8-fq34-vvx9

DOMPurify before 3.4.9 Trusted Types Policy State Contamination

Priority LOW 29

DOMPurify 3.0.0 before 3.4.9 does not reset the retained Trusted Types policy when clearConfig() is called, so a DOMPurify instance reused across trust boundaries stays bound to a previously supplied TRUSTED_TYPES_POLICY…

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00413 Published 2026-07-23 Partial fix · 3.4.9 CWE-693
TI-2026-46938 CVE-2026-65898 · GHSA-cmwh-pvxp-8882

DOMPurify before 3.4.11 Permanent Attribute Allowlist Pollution via setConfig

Priority LOW 23

DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute hook, allowing the hook to permanently mutate the shared allowlist.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00212 Published 2026-07-23 Partial fix · 3.4.11 CWE-79