StackRadar

CVE-2026-41238

Medium

Advisory

Published 22 Apr 2026In the index since 6 Sept 2026
Severity
Medium
worst across findings
CVSS
6.9
base score, highest
EPSS
0.002
13th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
32
of 17,781 indexed, latest versions
Container images
31
deployed by those charts
Fix available
1 of 1
affected package

DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING Fallback

Carried by container images the latest versions of 32 of 17,781 indexed charts deploy, on 31 images.

Affected packageAffected versionsFixed inImages
dompurifynpm3.0.5, 3.0.7, 3.0.11, 3.1.2+12 more3.4.031
OSV records
GHSA-v9jr-rg53-9pgp

Charts affected

32 by stars
ChartLatestAffected imagesRadar Score
wazuhwazuh-helm-morgovedVerified publisher2.0.71 of 5See more

wazuh wazuh-helm-morgoved 2.0.7

1 of the 5 container images this version deploys carry CVE-2026-41238.

Container imageDigestPackageFixed in
wazuh/wazuh-dashboard:4.14.391e4f0a7feed
dompurify@3.2.4
3.4.0

Open the chart page →

11,384
outlinekubitodevVerified publisher1.2.21 of 4See more

outline kubitodev 1.2.2

1 of the 4 container images this version deploys carry CVE-2026-41238.

Container imageDigestPackageFixed in
outlinewiki/outline:0.82.0494dfb9249a6
dompurify@3.2.3
3.4.0

Open the chart page →

5,352
krokicowboysysopVerified publisher6.1.01 of 5See more

kroki cowboysysop 6.1.0

1 of the 5 container images this version deploys carry CVE-2026-41238.

Container imageDigestPackageFixed in
yuzutech/kroki-excalidraw:0.29.157917319ea70
dompurify@3.1.6
3.4.0

Open the chart page →

6,743
wazuhwazuh-helmVerified publisher0.0.81 of 4See more

wazuh wazuh-helm 0.0.8

1 of the 4 container images this version deploys carry CVE-2026-41238.

Container imageDigestPackageFixed in
wazuh/wazuh-dashboard:4.11.10c58e7b47bb6
dompurify@3.1.4
3.4.0

Open the chart page →

6,168
karakeephelmforgeVerified publisher1.2.91 of 3See more

karakeep helmforge 1.2.9

1 of the 3 container images this version deploys carry CVE-2026-41238.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.33.2b069e4307dec
dompurify@3.2.6
3.4.0

Open the chart page →

9,460
nocodbzekker6Verified publisher1.10.01 of 1See more

nocodb zekker6 1.10.0

1 of the 1 container images this version deploys carry CVE-2026-41238.

Container imageDigestPackageFixed in
nocodb/nocodb:0.301.5d9516f0bf546
dompurify@3.3.3
3.4.0

Open the chart page →

4,016
opensearch-dashboardscaptnbpVerified publisher2.2.11 of 1See more

opensearch-dashboards captnbp 2.2.1

1 of the 1 container images this version deploys carry CVE-2026-41238.

Container imageDigestPackageFixed in
opensearchproject/opensearch-dashboards:2.15.0b7c26c60bfaf
dompurify@3.1.2
3.4.0

Open the chart page →

1,843
maildevchristianhuthVerified publisher1.6.01 of 1See more

maildev christianhuth 1.6.0

1 of the 1 container images this version deploys carry CVE-2026-41238.

Container imageDigestPackageFixed in
maildev/maildev:2.2.1180ef51f65ee
dompurify@3.1.6
3.4.0

Open the chart page →

1,143
joplin-serverdjjudas21Verified publisher5.5.81 of 1See more

joplin-server djjudas21 5.5.8

1 of the 1 container images this version deploys carry CVE-2026-41238.

Container imageDigestPackageFixed in
joplin/server:2.14.2-betab87564ef34e9
dompurify@3.0.5
3.4.0

Open the chart page →

3,925
karakeepself-hosters-by-nightVerified publisher2.5.11 of 1See more

karakeep self-hosters-by-night 2.5.1

1 of the 1 container images this version deploys carry CVE-2026-41238.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.27.1abd7d6b11b1b
dompurify@3.2.6
3.4.0

Open the chart page →

5,213
wikiwenerme2.2.01 of 2See more

wiki wenerme 2.2.0

1 of the 2 container images this version deploys carry CVE-2026-41238.

Container imageDigestPackageFixed in
requarks/wiki:latest68f0d1848261
dompurify@3.3.1
3.4.0

Open the chart page →

3,833
adeptia-automate-mcpadeptia-automate-mcp1.0.01 of 2See more

adeptia-automate-mcp adeptia-automate-mcp 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-41238.

Container imageDigestPackageFixed in
adeptiainc/adeptia-automate-observe:1.0.031f295e948e6
dompurify@3.3.2
3.4.0

Open the chart page →

3,600
ghostchart-ghost0.1.51 of 2See more

ghost chart-ghost 0.1.5

1 of the 2 container images this version deploys carry CVE-2026-41238.

Container imageDigestPackageFixed in
library/ghost:6.22.0-alpine3.23ac533a6988ee
dompurify@3.3.0
3.4.0

Open the chart page →

4,083
adventurelogdjjudas21Verified publisher0.1.11 of 3See more

adventurelog djjudas21 0.1.1

1 of the 3 container images this version deploys carry CVE-2026-41238.

Container imageDigestPackageFixed in
ghcr.io/seanmorley15/adventurelog-frontend:v0.13.051ee22428b41
dompurify@3.3.3
3.4.0

Open the chart page →

7,459
canary-checkerflanksourceVerified publisher1.2.01 of 2See more

canary-checker flanksource 1.2.0

1 of the 2 container images this version deploys carry CVE-2026-41238.

Container imageDigestPackageFixed in
flanksource/canary-checker-ui:v1.4.281764c84e550db
dompurify@3.2.6
3.4.0

Open the chart page →

4,650
archiveboxhelmforgeVerified publisher1.1.121 of 1See more

archivebox helmforge 1.1.12

1 of the 1 container images this version deploys carry CVE-2026-41238.

Container imageDigestPackageFixed in
archivebox/archivebox:0.7.41a5a37331091
dompurify@3.0.7
3.4.0

Open the chart page →

7,633
self-learning-platformhelm-self-learning-platformVerified publisher1.1.01 of 1See more

self-learning-platform helm-self-learning-platform 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-41238.

Container imageDigestPackageFixed in
devopsiaci/self-learning-platform:1.1.3d9441c931f75
dompurify@3.2.7
3.4.0

Open the chart page →

1,468
pangolinkrzwiatrzyk0.11.01 of 1See more

pangolin krzwiatrzyk 0.11.0

1 of the 1 container images this version deploys carry CVE-2026-41238.

Container imageDigestPackageFixed in
fosrl/pangolin:1.13.0c32ad797ab96
dompurify@3.2.7
3.4.0

Open the chart page →

3,441
ghostmt1905028.25.11 of 3See more

ghost mt190502 8.25.1

1 of the 3 container images this version deploys carry CVE-2026-41238.

Container imageDigestPackageFixed in
library/ghost:6.25.12654b1e90413
dompurify@3.3.0
3.4.0

Open the chart page →

4,960
nocodbone-acre-fundVerified publisher0.4.61 of 3See more

nocodb one-acre-fund 0.4.6

1 of the 3 container images this version deploys carry CVE-2026-41238.

Container imageDigestPackageFixed in
nocodb/nocodb:0.258.06779a4ddedf2
dompurify@3.2.0
3.4.0

Open the chart page →

4,219
readability-js-serverreadability-js-server0.1.01 of 1See more

readability-js-server readability-js-server 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-41238.

Container imageDigestPackageFixed in
phpdockerio/readability-js-server:1.8.0ea8354b42600
dompurify@3.3.1
3.4.0

Open the chart page →

1,858
karakeeprtomik-helm-chartsVerified publisher0.0.11 of 3See more

karakeep rtomik-helm-charts 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-41238.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.26.0f575a34ed3f8
dompurify@3.2.6
3.4.0

Open the chart page →

5,338
joplinrubxkubeVerified publisher1.3.11 of 2See more

joplin rubxkube 1.3.1

1 of the 2 container images this version deploys carry CVE-2026-41238.

Container imageDigestPackageFixed in
joplin/server:3.0-beta52af57880c0e
dompurify@3.0.5
3.4.0

Open the chart page →

7,413
speckle-server-branch-hotfix-2.19.1speckleVerified publisher2.19.2-branch.hotfix-2.19.1.124125-665e7e11 of 5See more

speckle-server-branch-hotfix-2.19.1 speckle 2.19.2-branch.hotfix-2.19.1.124125-665e7e1

1 of the 5 container images this version deploys carry CVE-2026-41238.

Container imageDigestPackageFixed in
speckle/speckle-frontend-2:2.19.2-branch.hotfix-2.19.1.124125-665e7e14f9241665ae3
dompurify@3.0.11
3.4.0

Open the chart page →

16,368
speckle-server-branch-hotfix-2.20.2speckleVerified publisher2.20.3-branch.hotfix-2.20.2.149555-37ea0cb1 of 5See more

speckle-server-branch-hotfix-2.20.2 speckle 2.20.3-branch.hotfix-2.20.2.149555-37ea0cb

1 of the 5 container images this version deploys carry CVE-2026-41238.

Container imageDigestPackageFixed in
speckle/speckle-frontend-2:2.20.3-branch.hotfix-2.20.2.149555-37ea0cbfdc008effc7a
dompurify@3.0.11
3.4.0

Open the chart page →

16,400
speckle-server-branch-testing1speckleVerified publisher2.20.6-branch.testing1.154030-9b091141 of 5See more

speckle-server-branch-testing1 speckle 2.20.6-branch.testing1.154030-9b09114

1 of the 5 container images this version deploys carry CVE-2026-41238.

Container imageDigestPackageFixed in
speckle/speckle-frontend-2:2.20.6-branch.testing1.154030-9b0911432fc940d9b4c
dompurify@3.0.11
3.4.0

Open the chart page →

16,400
speckle-server-branch-testing4speckleVerified publisher2.20.2-branch.testing4.134160-9fad4b21 of 5See more

speckle-server-branch-testing4 speckle 2.20.2-branch.testing4.134160-9fad4b2

1 of the 5 container images this version deploys carry CVE-2026-41238.

Container imageDigestPackageFixed in
speckle/speckle-frontend-2:2.20.2-branch.testing4.134160-9fad4b210ad4ade8bf2
dompurify@3.0.11
3.4.0

Open the chart page →

16,019
speckle-server-branch-testing5speckleVerified publisher2.21.3-branch.testing5.219631-2153bef1 of 5See more

speckle-server-branch-testing5 speckle 2.21.3-branch.testing5.219631-2153bef

1 of the 5 container images this version deploys carry CVE-2026-41238.

Container imageDigestPackageFixed in
speckle/speckle-frontend-2:2.21.3-branch.testing5.219631-2153befd4ca6ebf09b9
dompurify@3.0.11
3.4.0

Open the chart page →

15,635
excalidashunxwaresVerified publisher2026.2.51 of 2See more

excalidash unxwares 2026.2.5

1 of the 2 container images this version deploys carry CVE-2026-41238.

Container imageDigestPackageFixed in
zimengxiong/excalidash-backend:0.4.271273af713c91
dompurify@3.3.0
3.4.0

Open the chart page →

2,620
wazuhwazuh-helm-eksVerified publisher1.2.101 of 6See more

wazuh wazuh-helm-eks 1.2.10

1 of the 6 container images this version deploys carry CVE-2026-41238.

Container imageDigestPackageFixed in
wazuh/wazuh-dashboard:4.14.491c8d793746f
dompurify@3.2.4
3.4.0

Open the chart page →

5,484
wikiwikijs3.0.01 of 2See more

wiki wikijs 3.0.0

1 of the 2 container images this version deploys carry CVE-2026-41238.

Container imageDigestPackageFixed in
requarks/wiki:268f0d1848261
dompurify@3.3.1
3.4.0

Open the chart page →

5,459
ygdrassil-monitoringygdrassilVerified publisher0.4.01 of 10See more

ygdrassil-monitoring ygdrassil 0.4.0

1 of the 10 container images this version deploys carry CVE-2026-41238.

Container imageDigestPackageFixed in
opensearchproject/opensearch-dashboards:2.18.00ecd8444add2
dompurify@3.1.5
3.4.0

Open the chart page →

9,381

Container images carrying it

31 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
requarks/wiki:2:latest68f0d1848261
dompurify@3.3.1
3.4.0
2
adeptiainc/adeptia-automate-observe:1.0.031f295e948e6
dompurify@3.3.2
3.4.0
1
archivebox/archivebox:0.7.41a5a37331091
dompurify@3.0.7
3.4.0
1
devopsiaci/self-learning-platform:1.1.3d9441c931f75
dompurify@3.2.7
3.4.0
1
flanksource/canary-checker-ui:v1.4.281764c84e550db
dompurify@3.2.6
3.4.0
1
fosrl/pangolin:1.13.0c32ad797ab96
dompurify@3.2.7
3.4.0
1
joplin/server:3.0-beta52af57880c0e
dompurify@3.0.5
3.4.0
1
joplin/server:2.14.2-betab87564ef34e9
dompurify@3.0.5
3.4.0
1
library/ghost:6.25.12654b1e90413
dompurify@3.3.0
3.4.0
1
library/ghost:6.22.0-alpine3.23ac533a6988ee
dompurify@3.3.0
3.4.0
1
maildev/maildev:2.2.1180ef51f65ee
dompurify@3.1.6
3.4.0
1
nocodb/nocodb:0.258.06779a4ddedf2
dompurify@3.2.0
3.4.0
1
nocodb/nocodb:0.301.5d9516f0bf546
dompurify@3.3.3
3.4.0
1
opensearchproject/opensearch-dashboards:2.18.00ecd8444add2
dompurify@3.1.5
3.4.0
1
opensearchproject/opensearch-dashboards:2.15.0b7c26c60bfaf
dompurify@3.1.2
3.4.0
1
outlinewiki/outline:0.82.0494dfb9249a6
dompurify@3.2.3
3.4.0
1
phpdockerio/readability-js-server:1.8.0ea8354b42600
dompurify@3.3.1
3.4.0
1
speckle/speckle-frontend-2:2.20.2-branch.testing4.134160-9fad4b210ad4ade8bf2
dompurify@3.0.11
3.4.0
1
speckle/speckle-frontend-2:2.20.6-branch.testing1.154030-9b0911432fc940d9b4c
dompurify@3.0.11
3.4.0
1
speckle/speckle-frontend-2:2.19.2-branch.hotfix-2.19.1.124125-665e7e14f9241665ae3
dompurify@3.0.11
3.4.0
1
speckle/speckle-frontend-2:2.21.3-branch.testing5.219631-2153befd4ca6ebf09b9
dompurify@3.0.11
3.4.0
1
speckle/speckle-frontend-2:2.20.3-branch.hotfix-2.20.2.149555-37ea0cbfdc008effc7a
dompurify@3.0.11
3.4.0
1
wazuh/wazuh-dashboard:4.11.10c58e7b47bb6
dompurify@3.1.4
3.4.0
1
wazuh/wazuh-dashboard:4.14.491c8d793746f
dompurify@3.2.4
3.4.0
1
wazuh/wazuh-dashboard:4.14.391e4f0a7feed
dompurify@3.2.4
3.4.0
1
yuzutech/kroki-excalidraw:0.29.157917319ea70
dompurify@3.1.6
3.4.0
1
zimengxiong/excalidash-backend:0.4.271273af713c91
dompurify@3.3.0
3.4.0
1
ghcr.io/karakeep-app/karakeep:0.27.1abd7d6b11b1b
dompurify@3.2.6
3.4.0
1
ghcr.io/karakeep-app/karakeep:0.33.2b069e4307dec
dompurify@3.2.6
3.4.0
1
ghcr.io/karakeep-app/karakeep:0.26.0f575a34ed3f8
dompurify@3.2.6
3.4.0
1
ghcr.io/seanmorley15/adventurelog-frontend:v0.13.051ee22428b41
dompurify@3.3.3
3.4.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.