StackRadar

CVE-2026-109345

Low

Advisory

Published 5 Oct 2026In the index since 13 Oct 2026
Severity
Low
worst across findings
CVSS
2.0
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
97
of 18,108 indexed, latest versions
Container images
83
deployed by those charts
Fix available
1 of 1
affected package

DOMPurify: IN_PLACE returns a force-removed rawtext root whose text carries attacker markup — pure HTML reparse executes

Carried by container images the latest versions of 97 of 18,108 indexed charts deploy, on 83 images.

Affected packageAffected versionsFixed inImages
dompurifynpm1.0.11, 2.1.1, 2.2.6, 2.2.7+33 more3.4.1683
OSV records
GHSA-6688-9rhm-gjv2

Charts affected

97 by stars
ChartLatestAffected imagesRadar Score
opensearch-dashboardsopensearch-project-helm-chartsVerified publisher3.9.01 of 1See more

opensearch-dashboards opensearch-project-helm-charts 3.9.0

1 of the 1 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
opensearchproject/opensearch-dashboards:3.9.04bdb8ded547c
dompurify@3.4.13
3.4.16

Open the chart page →

351
wazuhwazuh-helm-morgovedVerified publisher2.0.71 of 5See more

wazuh wazuh-helm-morgoved 2.0.7

1 of the 5 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
wazuh/wazuh-dashboard:4.14.391e4f0a7feed
dompurify@3.2.4
3.4.16

Open the chart page →

13,878
homarrhomarr-labsOfficialVerified publisher8.34.11 of 1See more

homarr homarr-labs 8.34.1

1 of the 1 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
ghcr.io/homarr-labs/homarr:v2.4.1447267051fd7
dompurify@3.4.11
3.4.16

Open the chart page →

87
openclawopenclaw-helmVerified publisher1.5.401 of 2See more

openclaw openclaw-helm 1.5.40

1 of the 2 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
ghcr.io/openclaw/openclaw:2026.5.22dcfd14877740
dompurify@3.4.5
3.4.16

Open the chart page →

6,676
outlinekubitodevVerified publisher1.2.21 of 4See more

outline kubitodev 1.2.2

1 of the 4 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
outlinewiki/outline:0.82.0494dfb9249a6
dompurify@3.2.3
3.4.16

Open the chart page →

6,534
outlineoutline0.0.91 of 4See more

outline outline 0.0.9

1 of the 4 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
outlinewiki/outline:0.69.1d060dcd8f9aa
dompurify@2.4.3
3.4.16

Open the chart page →

5,660
krokicowboysysopVerified publisher6.2.01 of 5See more

kroki cowboysysop 6.2.0

1 of the 5 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
yuzutech/kroki-excalidraw:0.33.0f6ed8589e7f5
dompurify@3.4.12
3.4.16

Open the chart page →

2,253
hedgedocadfinisVerified publisher0.6.11 of 2See more

hedgedoc adfinis 0.6.1

1 of the 2 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.12.089bd85d7817f
dompurify@3.4.14
3.4.16

Open the chart page →

4,226
docmosthelmforgeVerified publisher1.4.11 of 4See more

docmost helmforge 1.4.1

1 of the 4 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
docmost/docmost:0.96.0b56947fcfd08
dompurify@3.4.13
3.4.16

Open the chart page →

4,700
wazuhwazuh-helmVerified publisher0.0.81 of 4See more

wazuh wazuh-helm 0.0.8

1 of the 4 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
wazuh/wazuh-dashboard:4.11.10c58e7b47bb6
dompurify@3.1.4
3.4.16

Open the chart page →

8,108
wikijsgeek-cookbookVerified publisher6.4.21 of 1See more

wikijs geek-cookbook 6.4.2

1 of the 1 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/wikijs:version-2.5.20158d377933678
dompurify@2.2.7
3.4.16

Open the chart page →

6,284
karakeephelmforgeVerified publisher1.2.91 of 3See more

karakeep helmforge 1.2.9

1 of the 3 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.33.2b069e4307dec
dompurify@3.2.6
3.4.16

Open the chart page →

12,204
kubernetes-loggingkubernetes-logging4.8.01 of 6See more

kubernetes-logging kubernetes-logging 4.8.0

1 of the 6 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
opensearchproject/opensearch-dashboards:2.10.0485a0019e5d6
dompurify@2.4.1
3.4.16

Open the chart page →

12,219
nightscoutgabe565Verified publisher0.13.01 of 2See more

nightscout gabe565 0.13.0

1 of the 2 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
nightscout/cgm-remote-monitor:15.0.2ad29ca7a4de6
dompurify@2.4.3
3.4.16

Open the chart page →

2,766
mealiegeek-cookbookVerified publisher5.1.21 of 2See more

mealie geek-cookbook 5.1.2

1 of the 2 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
hkotel/mealie:frontend-v1.0.0beta-23c04c0e85039
dompurify@2.3.8
3.4.16

Open the chart page →

9,368
ghost-on-kubernetesghost-on-kubernetes-helmVerified publisher2.0.21 of 3See more

ghost-on-kubernetes ghost-on-kubernetes-helm 2.0.2

1 of the 3 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
ghcr.io/sredevopsorg/ghost-on-kubernetes:main8da4c9948421
dompurify@3.4.13
3.4.16

Open the chart page →

1,850
graphql-hivegraphql-hive1.0.01 of 17See more

graphql-hive graphql-hive 1.0.0

1 of the 17 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
ghcr.io/kamilkisiela/graphql-hive/app:59b64c36c866b3555c135c70de76a884e63f8619a4a3639899f7
dompurify@2.3.10
3.4.16

Open the chart page →

12,154
hedgedocrobertobochetVerified publisher1.4.01 of 1See more

hedgedoc robertobochet 1.4.0

1 of the 1 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.12.089bd85d7817f
dompurify@3.4.14
3.4.16

Open the chart page →

1,492
nocodbzekker6Verified publisher1.10.01 of 1See more

nocodb zekker6 1.10.0

1 of the 1 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
nocodb/nocodb:0.301.5d9516f0bf546
dompurify@3.3.3
3.4.16

Open the chart page →

5,385
siemassist-iot-cybersecurity-monitroting-siem0.1.01 of 3See more

siem assist-iot-cybersecurity-monitroting-siem 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
assistiot/cybersecurity-monitoring_id-kbn:latest2297b4350211
dompurify@2.1.1
3.4.16

Open the chart page →

12,496
betterdb-monitorbetterdb-monitorOfficialVerified publisher0.49.01 of 1See more

betterdb-monitor betterdb-monitor 0.49.0

1 of the 1 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
betterdb/monitor:0.49.0-no-ai97dcd2d2192f
dompurify@3.4.13
3.4.16

Open the chart page →

608
opensearch-dashboardscaptnbpVerified publisher2.2.11 of 1See more

opensearch-dashboards captnbp 2.2.1

1 of the 1 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
opensearchproject/opensearch-dashboards:2.15.0b7c26c60bfaf
dompurify@2.4.7
3.4.16

Open the chart page →

2,085
maildevchristianhuthVerified publisher1.6.11 of 1See more

maildev christianhuth 1.6.1

1 of the 1 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
maildev/maildev:2.2.1180ef51f65ee
dompurify@3.1.6
3.4.16

Open the chart page →

1,548
kubedashdevopstalesOfficialVerified publisher4.0.01 of 8See more

kubedash devopstales 4.0.0

1 of the 8 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
patrikx3/p3x-redis-ui:latestf19eb45b0694
dompurify@3.4.14
3.4.16

Open the chart page →

12,914
recipesgeek-cookbookVerified publisher6.6.21 of 2See more

recipes geek-cookbook 6.6.2

1 of the 2 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
vabene1111/recipes:1.0.5.2ec4e9e2905b0
dompurify@2.3.4
3.4.16

Open the chart page →

8,735
plane-enterprisemakeplaneOfficialVerified publisher3.10.61 of 13See more

plane-enterprise makeplane 3.10.6

1 of the 13 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
makeplane/space-commercial:v3.3.230f27727e633
dompurify@3.4.13
3.4.16

Open the chart page →

6,992
karakeepself-hosters-by-nightVerified publisher2.5.11 of 1See more

karakeep self-hosters-by-night 2.5.1

1 of the 1 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.27.1abd7d6b11b1b
dompurify@3.2.6
3.4.16

Open the chart page →

6,252
supabasesupabse0.8.01 of 11See more

supabase supabse 0.8.0

1 of the 11 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
supabase/studio:2026.08.03-sha-022b374606aca9fdaa7
dompurify@3.4.12
3.4.16

Open the chart page →

22,526
wikiwenerme2.2.01 of 2See more

wiki wenerme 2.2.0

1 of the 2 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
requarks/wiki:latestfffff288a52f
dompurify@3.3.1
3.4.16

Open the chart page →

2,618
trifidzazukoOfficialVerified publisher0.2.11 of 1See more

trifid zazuko 0.2.1

1 of the 1 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
ghcr.io/zazuko/trifid:v6.0.159bda2bf65d4
dompurify@3.4.9
3.4.16

Open the chart page →

654
adeptia-automate-mcpadeptia-automate-mcp1.0.01 of 2See more

adeptia-automate-mcp adeptia-automate-mcp 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
adeptiainc/adeptia-automate-observe:1.0.031f295e948e6
dompurify@3.3.2
3.4.16

Open the chart page →

4,308
linkwardenadnoctemVerified publisher0.5.11 of 2See more

linkwarden adnoctem 0.5.1

1 of the 2 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
ghcr.io/linkwarden/linkwarden:v2.16.30664c28a039b
dompurify@3.4.14
3.4.16

Open the chart page →

5,142
outlineadnoctemVerified publisher0.1.21 of 1See more

outline adnoctem 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
outlinewiki/outline:1.10.1832051f039b4
dompurify@3.4.13
3.4.16

Open the chart page →

2,052
openapiassist-iot-open-api-management0.2.21 of 6See more

openapi assist-iot-open-api-management 0.2.2

1 of the 6 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
assistiot/open_api_frontend:1.0.1f11d82defc70
dompurify@2.3.10
3.4.16

Open the chart page →

93,492
opendistro-esbeeinventor1.15.11 of 3See more

opendistro-es beeinventor 1.15.1

1 of the 3 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
amazon/opendistro-for-elasticsearch-kibana:1.13.2c740d7a89475
dompurify@2.1.1
3.4.16

Open the chart page →

6,148
wazuhcsic-charts0.1.01 of 4See more

wazuh csic-charts 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
wazuh/wazuh-dashboard:4.4.11787550d2358
dompurify@2.4.1
3.4.16

Open the chart page →

16,052
dial-admindialVerified publisher0.19.01 of 3See more

dial-admin dial 0.19.0

1 of the 3 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
epam/ai-dial-admin-frontend:0.21.01ecee9f1aa09
dompurify@3.4.13
3.4.16

Open the chart page →

4,292
adventurelogdjjudas21Verified publisher0.1.11 of 3See more

adventurelog djjudas21 0.1.1

1 of the 3 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
ghcr.io/seanmorley15/adventurelog-frontend:v0.13.051ee22428b41
dompurify@3.3.3
3.4.16

Open the chart page →

10,107
hedgedocernail-hedgedoc5.0.01 of 1See more

hedgedoc ernail-hedgedoc 5.0.0

1 of the 1 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.10.8abdb6b08815d
dompurify@3.4.0
3.4.16

Open the chart page →

2,189
canary-checkerflanksourceVerified publisher1.2.01 of 2See more

canary-checker flanksource 1.2.0

1 of the 2 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
flanksource/canary-checker-ui:v1.4.281764c84e550db
dompurify@3.2.6
3.4.16

Open the chart page →

5,640
facetflanksourceVerified publisher0.1.731 of 1See more

facet flanksource 0.1.73

1 of the 1 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
ghcr.io/flanksource/facet:0.1.73a0323f4283e5
dompurify@3.4.12
3.4.16

Open the chart page →

26,978
flanksource-uiflanksourceVerified publisher1.4.3221 of 1See more

flanksource-ui flanksource 1.4.322

1 of the 1 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
flanksource/incident-manager-ui:v1.4.3228d17f0c08b20
dompurify@3.4.11
3.4.16

Open the chart page →

3,521
mission-controlflanksourceVerified publisher0.1.3391 of 8See more

mission-control flanksource 0.1.339

1 of the 8 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
flanksource/incident-manager-ui:v1.4.3228d17f0c08b20
dompurify@3.4.11
3.4.16

Open the chart page →

11,763
linkwardenfmjstudios0.3.61 of 2See more

linkwarden fmjstudios 0.3.6

1 of the 2 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
ghcr.io/linkwarden/linkwarden:v2.5.398214faf09f7
dompurify@3.0.6
3.4.16

Open the chart page →

3,930
nightscoutgeek-cookbookVerified publisher1.2.21 of 1See more

nightscout geek-cookbook 1.2.2

1 of the 1 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
nightscout/cgm-remote-monitor:14.2.500c3b4833f1b
dompurify@2.2.6
3.4.16

Open the chart page →

4,262
redis-uigin0.0.11 of 1See more

redis-ui gin 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
patrikx3/p3x-redis-ui:latestf19eb45b0694
dompurify@3.4.14
3.4.16

Open the chart page →

1,446
Governify-Bluejaygovernify0.1.01 of 12See more

Governify-Bluejay governify 0.1.0

1 of the 12 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
governify/assets-manager:v1.4.12987672448c7
dompurify@2.2.6
3.4.16

Open the chart page →

24,217
Governify-Falcongovernify0.1.01 of 10See more

Governify-Falcon governify 0.1.0

1 of the 10 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
governify/assets-manager:v1.4.12987672448c7
dompurify@2.2.6
3.4.16

Open the chart page →

26,638
hive-appgraphql-hive1.0.01 of 1See more

hive-app graphql-hive 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
ghcr.io/kamilkisiela/graphql-hive/app:59b64c36c866b3555c135c70de76a884e63f8619a4a3639899f7
dompurify@2.3.10
3.4.16

Open the chart page →

2,980
hive-appgraphql-hive-subcharts1.0.01 of 1See more

hive-app graphql-hive-subcharts 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
ghcr.io/kamilkisiela/graphql-hive/app:59b64c36c866b3555c135c70de76a884e63f8619a4a3639899f7
dompurify@2.3.10
3.4.16

Open the chart page →

2,980

Container images carrying it

83 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
speckle/speckle-frontend-2:2.19.2-branch.hotfix-2.19.1.124125-665e7e14f9241665ae3
dompurify@3.0.11
3.4.16
1
speckle/speckle-frontend-2:2.21.3-branch.testing5.219631-2153befd4ca6ebf09b9
dompurify@3.0.11
3.4.16
1
speckle/speckle-frontend-2:2.20.3-branch.hotfix-2.20.2.149555-37ea0cbfdc008effc7a
dompurify@3.0.11
3.4.16
1
supabase/studio:2026.08.03-sha-022b374606aca9fdaa7
dompurify@3.4.12
3.4.16
1
supabase/studio:latestd878dcd9dba7
dompurify@3.4.13
3.4.16
1
twentycrm/twenty:latest7ea7839b8945
dompurify@3.4.13
3.4.16
1
twentycrm/twenty:v2.43.0b2b662b1bef1
dompurify@3.4.13
3.4.16
1
twentycrm/twenty:v2.22.0e7d9948bf284
dompurify@3.4.11
3.4.16
1
vabene1111/recipes:1.0.5.2ec4e9e2905b0
dompurify@2.3.4
3.4.16
1
wazuh/wazuh-dashboard:4.11.10c58e7b47bb6
dompurify@3.1.4
3.4.16
1
wazuh/wazuh-dashboard:4.4.11787550d2358
dompurify@2.4.1
3.4.16
1
wazuh/wazuh-dashboard:4.14.491c8d793746f
dompurify@3.2.4
3.4.16
1
wazuh/wazuh-dashboard:4.14.391e4f0a7feed
dompurify@3.2.4
3.4.16
1
yuzutech/kroki-excalidraw:0.33.0f6ed8589e7f5
dompurify@3.4.12
3.4.16
1
zimengxiong/excalidash-backend:0.4.271273af713c91
dompurify@3.3.0
3.4.16
1
ghcr.io/flanksource/facet:0.1.73a0323f4283e5
dompurify@3.4.12
3.4.16
1
ghcr.io/homarr-labs/homarr:v2.4.1447267051fd7
dompurify@3.4.11
3.4.16
1
ghcr.io/homarr-labs/homarr:v1.77.2d60120a04536
dompurify@3.4.11
3.4.16
1
ghcr.io/homarr-labs/homarr:v1.77.2f0fb462299af
dompurify@3.4.11
3.4.16
1
ghcr.io/karakeep-app/karakeep:0.27.1abd7d6b11b1b
dompurify@3.2.6
3.4.16
1
ghcr.io/karakeep-app/karakeep:0.33.2b069e4307dec
dompurify@3.2.6
3.4.16
1
ghcr.io/karakeep-app/karakeep:0.26.0f575a34ed3f8
dompurify@3.2.6
3.4.16
1
ghcr.io/linkwarden/linkwarden:v2.16.30664c28a039b
dompurify@3.4.14
3.4.16
1
ghcr.io/linkwarden/linkwarden:v2.5.398214faf09f7
dompurify@3.0.6
3.4.16
1
ghcr.io/linuxserver/wikijs:version-2.5.20158d377933678
dompurify@2.2.7
3.4.16
1
ghcr.io/openclaw/openclaw:2026.5.22dcfd14877740
dompurify@3.4.5
3.4.16
1
ghcr.io/seanmorley15/adventurelog-frontend:v0.13.051ee22428b41
dompurify@3.3.3
3.4.16
1
ghcr.io/sillytavern/sillytavern:1.19.0eef27ff0c796
dompurify@3.4.2
3.4.16
1
ghcr.io/sredevopsorg/ghost-on-kubernetes:main8da4c9948421
dompurify@3.4.13
3.4.16
1
ghcr.io/zazuko/trifid:v6.0.159bda2bf65d4
dompurify@3.4.9
3.4.16
1
quay.io/hedgedoc/hedgedoc:1.10.8abdb6b08815d
dompurify@3.4.0
3.4.16
1
quay.io/rht-labs/stack-do500:3.0.86ba82beff18e
dompurify@2.3.1
3.4.16
1
quay.io/wekan/wekan:v5.65cb17600883a3
dompurify@2.3.3
3.4.16
1

syft 1.42.1 · advisories as of 13 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.