StackRadar

CVE-2026-109345

Low

Advisory

Published 5 Oct 2026In the index since 13 Oct 2026
Severity
Low
worst across findings
CVSS
2.0
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
97
of 18,108 indexed, latest versions
Container images
83
deployed by those charts
Fix available
1 of 1
affected package

DOMPurify: IN_PLACE returns a force-removed rawtext root whose text carries attacker markup — pure HTML reparse executes

Carried by container images the latest versions of 97 of 18,108 indexed charts deploy, on 83 images.

Affected packageAffected versionsFixed inImages
dompurifynpm1.0.11, 2.1.1, 2.2.6, 2.2.7+33 more3.4.1683
OSV records
GHSA-6688-9rhm-gjv2

Charts affected

97 by stars
ChartLatestAffected imagesRadar Score
appwritehelmforgeVerified publisher2.0.31 of 5See more

appwrite helmforge 2.0.3

1 of the 5 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
appwrite/new:1.1.159-self-hosted1811ce1d8154
dompurify@3.2.7
3.4.16

Open the chart page →

5,376
archiveboxhelmforgeVerified publisher1.1.131 of 1See more

archivebox helmforge 1.1.13

1 of the 1 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
archivebox/archivebox:0.9.708c21bb233130
dompurify@2.5.9
3.4.16

Open the chart page →

6,350
ghosthelmforgeVerified publisher1.2.101 of 3See more

ghost helmforge 1.2.10

1 of the 3 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
library/ghost:6.65.090592b712b6b
dompurify@3.4.13
3.4.16

Open the chart page →

3,929
homarrhelmforgeVerified publisher1.2.111 of 1See more

homarr helmforge 1.2.11

1 of the 1 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
ghcr.io/homarr-labs/homarr:v1.77.2f0fb462299af
dompurify@3.4.11
3.4.16

Open the chart page →

732
strapihelmforgeVerified publisher2.3.151 of 3See more

strapi helmforge 2.3.15

1 of the 3 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
helmforge/strapi-base:5.52.270e9143d6d92
dompurify@3.4.13
3.4.16

Open the chart page →

3,016
twentyhelmforgeVerified publisher1.0.41 of 5See more

twenty helmforge 1.0.4

1 of the 5 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
twentycrm/twenty:v2.43.0b2b662b1bef1
dompurify@3.4.13
3.4.16

Open the chart page →

3,202
self-learning-platformhelm-self-learning-platformVerified publisher1.1.01 of 1See more

self-learning-platform helm-self-learning-platform 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
devopsiaci/self-learning-platform:1.1.3d9441c931f75
dompurify@3.2.7
3.4.16

Open the chart page →

1,622
wikijshomeenterpriseinc1.4.01 of 1See more

wikijs homeenterpriseinc 1.4.0

1 of the 1 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
requarks/wiki:canary-2.5.2438b5865a7386c
dompurify@2.2.7
3.4.16

Open the chart page →

4,617
nocodbinseefrlab0.2.01 of 1See more

nocodb inseefrlab 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
nocodb/nocodb:latest27d2fd14670d
dompurify@3.4.13
3.4.16

Open the chart page →

304
ghostjanip81-helm-chartsVerified publisher0.1.21 of 1See more

ghost janip81-helm-charts 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
library/ghost:6.37.01ef2e532ca4d
dompurify@3.4.1
3.4.16

Open the chart page →

4,799
ghostk8s-home-lab-repo4.1.01 of 1See more

ghost k8s-home-lab-repo 4.1.0

1 of the 1 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
library/ghost:6.41.129773d6be407
dompurify@3.4.1
3.4.16

Open the chart page →

4,310
pangolinkrzwiatrzyk0.11.01 of 1See more

pangolin krzwiatrzyk 0.11.0

1 of the 1 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
fosrl/pangolin:1.13.0c32ad797ab96
dompurify@3.2.7
3.4.16

Open the chart page →

3,885
ghostkubernetes-homelab-helm-chartsVerified publisher0.2.31 of 2See more

ghost kubernetes-homelab-helm-charts 0.2.3

1 of the 2 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
library/ghost:6.39.0-alpine77196da4b0df
dompurify@3.4.1
3.4.16

Open the chart page →

4,212
kyso-frontkyso1.0.01 of 1See more

kyso-front kyso 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
kyso/kyso-front:lateste52595c5c16f
dompurify@2.3.10
3.4.16

Open the chart page →

2,880
homarrmedia-servarrVerified publisher0.56.01 of 1See more

homarr media-servarr 0.56.0

1 of the 1 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
ghcr.io/homarr-labs/homarr:v1.77.2d60120a04536
dompurify@3.4.11
3.4.16

Open the chart page →

732
aws-api-gateway-operatormintel0.1.21 of 11See more

aws-api-gateway-operator mintel 0.1.2

1 of the 11 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
opensearchproject/opensearch-dashboards:1.0.039695180364b
dompurify@2.1.1
3.4.16

Open the chart page →

11,960
standard-application-stackmintel11.5.01 of 12See more

standard-application-stack mintel 11.5.0

1 of the 12 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
opensearchproject/opensearch-dashboards:1.0.039695180364b
dompurify@2.1.1
3.4.16

Open the chart page →

12,141
ghostmt1905028.25.11 of 3See more

ghost mt190502 8.25.1

1 of the 3 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
library/ghost:6.25.12654b1e90413
dompurify@3.3.0
3.4.16

Open the chart page →

6,569
nightscoutmt1905021.1.01 of 3See more

nightscout mt190502 1.1.0

1 of the 3 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
nightscout/cgm-remote-monitor:15.0.3f604dc4c03ca
dompurify@2.4.3
3.4.16

Open the chart page →

7,549
friendicanicholaswildeVerified publisher1.0.01 of 1See more

friendica nicholaswilde 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
library/friendica:2021.04832e02b53466
dompurify@1.0.11
3.4.16

Open the chart page →

3,095
nocodbone-acre-fundVerified publisher0.4.61 of 3See more

nocodb one-acre-fund 0.4.6

1 of the 3 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
nocodb/nocodb:0.258.06779a4ddedf2
dompurify@3.2.0
3.4.16

Open the chart page →

5,346
readability-js-serverreadability-js-server0.1.01 of 1See more

readability-js-server readability-js-server 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
phpdockerio/readability-js-server:1.8.0ea8354b42600
dompurify@3.3.1
3.4.16

Open the chart page →

2,164
stackrox-chartredhat-cop0.0.101 of 1See more

stackrox-chart redhat-cop 0.0.10

1 of the 1 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
quay.io/rht-labs/stack-do500:3.0.86ba82beff18e
dompurify@2.3.1
3.4.16

Open the chart page →

31,211
karakeeprtomik-helm-chartsVerified publisher0.0.11 of 3See more

karakeep rtomik-helm-charts 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.26.0f575a34ed3f8
dompurify@3.2.6
3.4.16

Open the chart page →

6,347
joplinrubxkubeVerified publisher1.3.11 of 2See more

joplin rubxkube 1.3.1

1 of the 2 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
joplin/server:3.0-beta52af57880c0e
dompurify@3.0.5
3.4.16

Open the chart page →

8,250
outlineschmitzis0.0.81 of 4See more

outline schmitzis 0.0.8

1 of the 4 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
outlinewiki/outline:0.69.1d060dcd8f9aa
dompurify@2.4.3
3.4.16

Open the chart page →

5,660
wekanschmitzis1.1.11 of 1See more

wekan schmitzis 1.1.1

1 of the 1 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
quay.io/wekan/wekan:v5.65cb17600883a3
dompurify@2.3.3
3.4.16

Open the chart page →

3,911
hedgedocsi-gitops0.12.31 of 2See more

hedgedoc si-gitops 0.12.3

1 of the 2 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.12.089bd85d7817f
dompurify@3.4.14
3.4.16

Open the chart page →

3,921
sillytavernsillytavern0.1.191 of 1See more

sillytavern sillytavern 0.1.19

1 of the 1 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
ghcr.io/sillytavern/sillytavern:1.19.0eef27ff0c796
dompurify@3.4.2
3.4.16

Open the chart page →

2,193
infisicalsinextraVerified publisher0.6.11 of 1See more

infisical sinextra 0.6.1

1 of the 1 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
infisical/infisical:v0.165.166b911e3938ac
dompurify@3.4.14
3.4.16

Open the chart page →

3,745
speckle-server-branch-hotfix-2.19.1speckleVerified publisher2.19.2-branch.hotfix-2.19.1.124125-665e7e11 of 5See more

speckle-server-branch-hotfix-2.19.1 speckle 2.19.2-branch.hotfix-2.19.1.124125-665e7e1

1 of the 5 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
speckle/speckle-frontend-2:2.19.2-branch.hotfix-2.19.1.124125-665e7e14f9241665ae3
dompurify@3.0.11
3.4.16

Open the chart page →

18,224
speckle-server-branch-hotfix-2.20.2speckleVerified publisher2.20.3-branch.hotfix-2.20.2.149555-37ea0cb1 of 5See more

speckle-server-branch-hotfix-2.20.2 speckle 2.20.3-branch.hotfix-2.20.2.149555-37ea0cb

1 of the 5 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
speckle/speckle-frontend-2:2.20.3-branch.hotfix-2.20.2.149555-37ea0cbfdc008effc7a
dompurify@3.0.11
3.4.16

Open the chart page →

18,309
speckle-server-branch-testing1speckleVerified publisher2.20.6-branch.testing1.154030-9b091141 of 5See more

speckle-server-branch-testing1 speckle 2.20.6-branch.testing1.154030-9b09114

1 of the 5 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
speckle/speckle-frontend-2:2.20.6-branch.testing1.154030-9b0911432fc940d9b4c
dompurify@3.0.11
3.4.16

Open the chart page →

18,309
speckle-server-branch-testing4speckleVerified publisher2.20.2-branch.testing4.134160-9fad4b21 of 5See more

speckle-server-branch-testing4 speckle 2.20.2-branch.testing4.134160-9fad4b2

1 of the 5 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
speckle/speckle-frontend-2:2.20.2-branch.testing4.134160-9fad4b210ad4ade8bf2
dompurify@3.0.11
3.4.16

Open the chart page →

17,877
speckle-server-branch-testing5speckleVerified publisher2.21.3-branch.testing5.219631-2153bef1 of 5See more

speckle-server-branch-testing5 speckle 2.21.3-branch.testing5.219631-2153bef

1 of the 5 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
speckle/speckle-frontend-2:2.21.3-branch.testing5.219631-2153befd4ca6ebf09b9
dompurify@3.0.11
3.4.16

Open the chart page →

17,494
supabaseteochenglim0.1.21 of 13See more

supabase teochenglim 0.1.2

1 of the 13 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
supabase/studio:latestd878dcd9dba7
dompurify@3.4.13
3.4.16

Open the chart page →

10,529
twentytwenty-crm0.1.111 of 4See more

twenty twenty-crm 0.1.11

1 of the 4 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
twentycrm/twenty:v2.22.0e7d9948bf284
dompurify@3.4.11
3.4.16

Open the chart page →

6,706
excalidashunxwaresVerified publisher2026.2.51 of 2See more

excalidash unxwares 2026.2.5

1 of the 2 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
zimengxiong/excalidash-backend:0.4.271273af713c91
dompurify@3.3.0
3.4.16

Open the chart page →

2,883
twenty-crmvictorlane0.0.11 of 3See more

twenty-crm victorlane 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
twentycrm/twenty:latest7ea7839b8945
dompurify@3.4.13
3.4.16

Open the chart page →

73,760
wazuhwazuh-helm-eksVerified publisher1.2.101 of 6See more

wazuh wazuh-helm-eks 1.2.10

1 of the 6 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
wazuh/wazuh-dashboard:4.14.491c8d793746f
dompurify@3.2.4
3.4.16

Open the chart page →

7,493
opensearch-dashboardswener3.9.01 of 1See more

opensearch-dashboards wener 3.9.0

1 of the 1 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
opensearchproject/opensearch-dashboards:3.9.04bdb8ded547c
dompurify@3.4.13
3.4.16

Open the chart page →

351
wikiwener2.2.01 of 2See more

wiki wener 2.2.0

1 of the 2 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
requarks/wiki:latestfffff288a52f
dompurify@3.3.1
3.4.16

Open the chart page →

2,618
opensearch-dashboardswenerme3.9.01 of 1See more

opensearch-dashboards wenerme 3.9.0

1 of the 1 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
opensearchproject/opensearch-dashboards:3.9.04bdb8ded547c
dompurify@3.4.13
3.4.16

Open the chart page →

351
wikiwikijs3.0.01 of 2See more

wiki wikijs 3.0.0

1 of the 2 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
requarks/wiki:2fffff288a52f
dompurify@3.3.1
3.4.16

Open the chart page →

4,424
kibanawiremindVerified publisher8.5.241 of 2See more

kibana wiremind 8.5.24

1 of the 2 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
library/kibana:8.19.2235544f1ff28a
dompurify@3.4.14
3.4.16

Open the chart page →

1,779
opendistro-eswitcom-gmbh1.13.31 of 3See more

opendistro-es witcom-gmbh 1.13.3

1 of the 3 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
amazon/opendistro-for-elasticsearch-kibana:1.13.2c740d7a89475
dompurify@2.1.1
3.4.16

Open the chart page →

6,148
ygdrassil-monitoringygdrassilVerified publisher0.4.01 of 10See more

ygdrassil-monitoring ygdrassil 0.4.0

1 of the 10 container images this version deploys carry CVE-2026-109345.

Container imageDigestPackageFixed in
opensearchproject/opensearch-dashboards:2.18.00ecd8444add2
dompurify@2.5.6
3.4.16

Open the chart page →

13,848

Container images carrying it

83 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
speckle/speckle-frontend-2:2.19.2-branch.hotfix-2.19.1.124125-665e7e14f9241665ae3
dompurify@3.0.11
3.4.16
1
speckle/speckle-frontend-2:2.21.3-branch.testing5.219631-2153befd4ca6ebf09b9
dompurify@3.0.11
3.4.16
1
speckle/speckle-frontend-2:2.20.3-branch.hotfix-2.20.2.149555-37ea0cbfdc008effc7a
dompurify@3.0.11
3.4.16
1
supabase/studio:2026.08.03-sha-022b374606aca9fdaa7
dompurify@3.4.12
3.4.16
1
supabase/studio:latestd878dcd9dba7
dompurify@3.4.13
3.4.16
1
twentycrm/twenty:latest7ea7839b8945
dompurify@3.4.13
3.4.16
1
twentycrm/twenty:v2.43.0b2b662b1bef1
dompurify@3.4.13
3.4.16
1
twentycrm/twenty:v2.22.0e7d9948bf284
dompurify@3.4.11
3.4.16
1
vabene1111/recipes:1.0.5.2ec4e9e2905b0
dompurify@2.3.4
3.4.16
1
wazuh/wazuh-dashboard:4.11.10c58e7b47bb6
dompurify@3.1.4
3.4.16
1
wazuh/wazuh-dashboard:4.4.11787550d2358
dompurify@2.4.1
3.4.16
1
wazuh/wazuh-dashboard:4.14.491c8d793746f
dompurify@3.2.4
3.4.16
1
wazuh/wazuh-dashboard:4.14.391e4f0a7feed
dompurify@3.2.4
3.4.16
1
yuzutech/kroki-excalidraw:0.33.0f6ed8589e7f5
dompurify@3.4.12
3.4.16
1
zimengxiong/excalidash-backend:0.4.271273af713c91
dompurify@3.3.0
3.4.16
1
ghcr.io/flanksource/facet:0.1.73a0323f4283e5
dompurify@3.4.12
3.4.16
1
ghcr.io/homarr-labs/homarr:v2.4.1447267051fd7
dompurify@3.4.11
3.4.16
1
ghcr.io/homarr-labs/homarr:v1.77.2d60120a04536
dompurify@3.4.11
3.4.16
1
ghcr.io/homarr-labs/homarr:v1.77.2f0fb462299af
dompurify@3.4.11
3.4.16
1
ghcr.io/karakeep-app/karakeep:0.27.1abd7d6b11b1b
dompurify@3.2.6
3.4.16
1
ghcr.io/karakeep-app/karakeep:0.33.2b069e4307dec
dompurify@3.2.6
3.4.16
1
ghcr.io/karakeep-app/karakeep:0.26.0f575a34ed3f8
dompurify@3.2.6
3.4.16
1
ghcr.io/linkwarden/linkwarden:v2.16.30664c28a039b
dompurify@3.4.14
3.4.16
1
ghcr.io/linkwarden/linkwarden:v2.5.398214faf09f7
dompurify@3.0.6
3.4.16
1
ghcr.io/linuxserver/wikijs:version-2.5.20158d377933678
dompurify@2.2.7
3.4.16
1
ghcr.io/openclaw/openclaw:2026.5.22dcfd14877740
dompurify@3.4.5
3.4.16
1
ghcr.io/seanmorley15/adventurelog-frontend:v0.13.051ee22428b41
dompurify@3.3.3
3.4.16
1
ghcr.io/sillytavern/sillytavern:1.19.0eef27ff0c796
dompurify@3.4.2
3.4.16
1
ghcr.io/sredevopsorg/ghost-on-kubernetes:main8da4c9948421
dompurify@3.4.13
3.4.16
1
ghcr.io/zazuko/trifid:v6.0.159bda2bf65d4
dompurify@3.4.9
3.4.16
1
quay.io/hedgedoc/hedgedoc:1.10.8abdb6b08815d
dompurify@3.4.0
3.4.16
1
quay.io/rht-labs/stack-do500:3.0.86ba82beff18e
dompurify@2.3.1
3.4.16
1
quay.io/wekan/wekan:v5.65cb17600883a3
dompurify@2.3.3
3.4.16
1

syft 1.42.1 · advisories as of 13 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.