StackRadarChart IndexLive demo

CVE-2026-49458

Medium

Advisory

Published 15 Jun 2026In the index since 6 Sept 2026

Severity: Medium; worst across findings
CVSS: 6.1; base score, highest
EPSS: 0.004; 34th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 63; of 17,781 indexed, latest versions
Container images: 56; deployed by those charts
Fix available: 1 of 1; affected package

DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks

Carried by container images the latest versions of 63 of 17,781 indexed charts deploy, on 56 images.

Affected package	Affected versions	Fixed in	Images
dompurifynpm	2.1.1, 2.2.6, 2.2.7, 2.3.1+25 more	3.4.6	56

OSV records: GHSA-hpcv-96wg-7vj8

Charts affected

63 by stars

Chart

Latest

Affected images

Radar Score

joplinrubxkube

1 of 2 See more

joplin rubxkube 1.3.1

1 of the 2 container images this version deploys carry CVE-2026-49458.

Container image	Digest	Package	Fixed in
joplin/server :3.0-beta	52af57880c0e	dompurify@3.0.5	3.4.6

Open the chart page →

7,413

outlineschmitzis

1 of 4 See more

outline schmitzis 0.0.8

1 of the 4 container images this version deploys carry CVE-2026-49458.

Container image	Digest	Package	Fixed in
outlinewiki/outline :0.69.1	d060dcd8f9aa	dompurify@2.4.3	3.4.6

Open the chart page →

4,431

wekanschmitzis

1 of 1 See more

wekan schmitzis 1.1.1

1 of the 1 container images this version deploys carry CVE-2026-49458.

Container image	Digest	Package	Fixed in
quay.io/wekan/wekan :v5.65	cb17600883a3	dompurify@2.3.3	3.4.6

Open the chart page →

3,638

speckle-server-branch-hotfix-2.19.1speckle

2.19.2-branch.hotfix-2.19.1.124125-665e7e1

1 of 5 See more

speckle-server-branch-hotfix-2.19.1 speckle 2.19.2-branch.hotfix-2.19.1.124125-665e7e1

1 of the 5 container images this version deploys carry CVE-2026-49458.

Container image	Digest	Package	Fixed in
speckle/speckle-frontend-2 :2.19.2-branch.hotfix-2.19.1.124125-665e7e1	4f9241665ae3	dompurify@3.0.11	3.4.6

Open the chart page →

16,368

speckle-server-branch-hotfix-2.20.2speckle

2.20.3-branch.hotfix-2.20.2.149555-37ea0cb

1 of 5 See more

speckle-server-branch-hotfix-2.20.2 speckle 2.20.3-branch.hotfix-2.20.2.149555-37ea0cb

1 of the 5 container images this version deploys carry CVE-2026-49458.

Container image	Digest	Package	Fixed in
speckle/speckle-frontend-2 :2.20.3-branch.hotfix-2.20.2.149555-37ea0cb	fdc008effc7a	dompurify@3.0.11	3.4.6

Open the chart page →

16,400

speckle-server-branch-testing1speckle

2.20.6-branch.testing1.154030-9b09114

1 of 5 See more

speckle-server-branch-testing1 speckle 2.20.6-branch.testing1.154030-9b09114

1 of the 5 container images this version deploys carry CVE-2026-49458.

Container image	Digest	Package	Fixed in
speckle/speckle-frontend-2 :2.20.6-branch.testing1.154030-9b09114	32fc940d9b4c	dompurify@3.0.11	3.4.6

Open the chart page →

16,400

speckle-server-branch-testing4speckle

2.20.2-branch.testing4.134160-9fad4b2

1 of 5 See more

speckle-server-branch-testing4 speckle 2.20.2-branch.testing4.134160-9fad4b2

1 of the 5 container images this version deploys carry CVE-2026-49458.

Container image	Digest	Package	Fixed in
speckle/speckle-frontend-2 :2.20.2-branch.testing4.134160-9fad4b2	10ad4ade8bf2	dompurify@3.0.11	3.4.6

Open the chart page →

16,019

speckle-server-branch-testing5speckle

2.21.3-branch.testing5.219631-2153bef

1 of 5 See more

speckle-server-branch-testing5 speckle 2.21.3-branch.testing5.219631-2153bef

1 of the 5 container images this version deploys carry CVE-2026-49458.

Container image	Digest	Package	Fixed in
speckle/speckle-frontend-2 :2.21.3-branch.testing5.219631-2153bef	d4ca6ebf09b9	dompurify@3.0.11	3.4.6

Open the chart page →

15,635

excalidashunxwares

1 of 2 See more

excalidash unxwares 2026.2.5

1 of the 2 container images this version deploys carry CVE-2026-49458.

Container image	Digest	Package	Fixed in
zimengxiong/excalidash-backend :0.4.27	1273af713c91	dompurify@3.3.0	3.4.6

Open the chart page →

2,620

wazuhwazuh-helm-eks

1 of 6 See more

wazuh wazuh-helm-eks 1.2.10

1 of the 6 container images this version deploys carry CVE-2026-49458.

Container image	Digest	Package	Fixed in
wazuh/wazuh-dashboard :4.14.4	91c8d793746f	dompurify@3.2.4	3.4.6

Open the chart page →

5,484

wikiwikijs

1 of 2 See more

5,459

opendistro-eswitcom-gmbh

1 of 3 See more

opendistro-es witcom-gmbh 1.13.3

1 of the 3 container images this version deploys carry CVE-2026-49458.

Container image	Digest	Package	Fixed in
amazon/opendistro-for-elasticsearch-kibana :1.13.2	c740d7a89475	dompurify@2.1.1	3.4.6

Open the chart page →

5,806

ygdrassil-monitoringygdrassil

1 of 10 See more

ygdrassil-monitoring ygdrassil 0.4.0

1 of the 10 container images this version deploys carry CVE-2026-49458.

Container image	Digest	Package	Fixed in
opensearchproject/opensearch-dashboards :2.18.0	0ecd8444add2	dompurify@2.5.6	3.4.6

Open the chart page →

9,381

Container images carrying it

56 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/linuxserver/wikijs :version-2.5.201	58d377933678	dompurify@2.2.7	3.4.6	1
ghcr.io/openclaw/openclaw :2026.5.22	dcfd14877740	dompurify@3.4.5	3.4.6	1
ghcr.io/seanmorley15/adventurelog-frontend :v0.13.0	51ee22428b41	dompurify@3.3.3	3.4.6	1
quay.io/hedgedoc/hedgedoc :1.10.8	abdb6b08815d	dompurify@3.4.0	3.4.6	1
quay.io/rht-labs/stack-do500 :3.0.8	6ba82beff18e	dompurify@2.3.1	3.4.6	1
quay.io/wekan/wekan :v5.65	cb17600883a3	dompurify@2.3.3	3.4.6	1