StackRadarChart IndexLive demo

CVE-2026-49459

Medium

Advisory

Published 15 Jun 2026In the index since 6 Sept 2026

Severity: Medium; worst across findings
CVSS: 6.1; base score, highest
EPSS: 0.004; 30th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 63; of 17,781 indexed, latest versions
Container images: 56; deployed by those charts
Fix available: 1 of 1; affected package

DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM

Carried by container images the latest versions of 63 of 17,781 indexed charts deploy, on 56 images.

Affected package	Affected versions	Fixed in	Images
dompurifynpm	2.1.1, 2.2.6, 2.2.7, 2.3.1+25 more	3.4.6	56

OSV records: GHSA-r47g-fvhr-h676

Charts affected

63 by stars

Chart

Latest

Affected images

Radar Score

joplinrubxkube

1 of 2 See more

joplin rubxkube 1.3.1

1 of the 2 container images this version deploys carry CVE-2026-49459.

Container image	Digest	Package	Fixed in
joplin/server :3.0-beta	52af57880c0e	dompurify@3.0.5	3.4.6

Open the chart page →

7,413

outlineschmitzis

1 of 4 See more

outline schmitzis 0.0.8

1 of the 4 container images this version deploys carry CVE-2026-49459.

Container image	Digest	Package	Fixed in
outlinewiki/outline :0.69.1	d060dcd8f9aa	dompurify@2.4.3	3.4.6

Open the chart page →

4,431

wekanschmitzis

1 of 1 See more

wekan schmitzis 1.1.1

1 of the 1 container images this version deploys carry CVE-2026-49459.

Container image	Digest	Package	Fixed in
quay.io/wekan/wekan :v5.65	cb17600883a3	dompurify@2.3.3	3.4.6

Open the chart page →

3,638

speckle-server-branch-hotfix-2.19.1speckle

2.19.2-branch.hotfix-2.19.1.124125-665e7e1

1 of 5 See more

speckle-server-branch-hotfix-2.19.1 speckle 2.19.2-branch.hotfix-2.19.1.124125-665e7e1

1 of the 5 container images this version deploys carry CVE-2026-49459.

Container image	Digest	Package	Fixed in
speckle/speckle-frontend-2 :2.19.2-branch.hotfix-2.19.1.124125-665e7e1	4f9241665ae3	dompurify@3.0.11	3.4.6

Open the chart page →

16,368

speckle-server-branch-hotfix-2.20.2speckle

2.20.3-branch.hotfix-2.20.2.149555-37ea0cb

1 of 5 See more

speckle-server-branch-hotfix-2.20.2 speckle 2.20.3-branch.hotfix-2.20.2.149555-37ea0cb

1 of the 5 container images this version deploys carry CVE-2026-49459.

Container image	Digest	Package	Fixed in
speckle/speckle-frontend-2 :2.20.3-branch.hotfix-2.20.2.149555-37ea0cb	fdc008effc7a	dompurify@3.0.11	3.4.6

Open the chart page →

16,400

speckle-server-branch-testing1speckle

2.20.6-branch.testing1.154030-9b09114

1 of 5 See more

speckle-server-branch-testing1 speckle 2.20.6-branch.testing1.154030-9b09114

1 of the 5 container images this version deploys carry CVE-2026-49459.

Container image	Digest	Package	Fixed in
speckle/speckle-frontend-2 :2.20.6-branch.testing1.154030-9b09114	32fc940d9b4c	dompurify@3.0.11	3.4.6

Open the chart page →

16,400

speckle-server-branch-testing4speckle

2.20.2-branch.testing4.134160-9fad4b2

1 of 5 See more

speckle-server-branch-testing4 speckle 2.20.2-branch.testing4.134160-9fad4b2

1 of the 5 container images this version deploys carry CVE-2026-49459.

Container image	Digest	Package	Fixed in
speckle/speckle-frontend-2 :2.20.2-branch.testing4.134160-9fad4b2	10ad4ade8bf2	dompurify@3.0.11	3.4.6

Open the chart page →

16,019

speckle-server-branch-testing5speckle

2.21.3-branch.testing5.219631-2153bef

1 of 5 See more

speckle-server-branch-testing5 speckle 2.21.3-branch.testing5.219631-2153bef

1 of the 5 container images this version deploys carry CVE-2026-49459.

Container image	Digest	Package	Fixed in
speckle/speckle-frontend-2 :2.21.3-branch.testing5.219631-2153bef	d4ca6ebf09b9	dompurify@3.0.11	3.4.6

Open the chart page →

15,635

excalidashunxwares

1 of 2 See more

excalidash unxwares 2026.2.5

1 of the 2 container images this version deploys carry CVE-2026-49459.

Container image	Digest	Package	Fixed in
zimengxiong/excalidash-backend :0.4.27	1273af713c91	dompurify@3.3.0	3.4.6

Open the chart page →

2,620

wazuhwazuh-helm-eks

1 of 6 See more

wazuh wazuh-helm-eks 1.2.10

1 of the 6 container images this version deploys carry CVE-2026-49459.

Container image	Digest	Package	Fixed in
wazuh/wazuh-dashboard :4.14.4	91c8d793746f	dompurify@3.2.4	3.4.6

Open the chart page →

5,484

wikiwikijs

1 of 2 See more

5,459

opendistro-eswitcom-gmbh

1 of 3 See more

opendistro-es witcom-gmbh 1.13.3

1 of the 3 container images this version deploys carry CVE-2026-49459.

Container image	Digest	Package	Fixed in
amazon/opendistro-for-elasticsearch-kibana :1.13.2	c740d7a89475	dompurify@2.1.1	3.4.6

Open the chart page →

5,806

ygdrassil-monitoringygdrassil

1 of 10 See more

ygdrassil-monitoring ygdrassil 0.4.0

1 of the 10 container images this version deploys carry CVE-2026-49459.

Container image	Digest	Package	Fixed in
opensearchproject/opensearch-dashboards :2.18.0	0ecd8444add2	dompurify@2.5.6	3.4.6

Open the chart page →

9,381

Container images carrying it

56 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/linuxserver/wikijs :version-2.5.201	58d377933678	dompurify@2.2.7	3.4.6	1
ghcr.io/openclaw/openclaw :2026.5.22	dcfd14877740	dompurify@3.4.5	3.4.6	1
ghcr.io/seanmorley15/adventurelog-frontend :v0.13.0	51ee22428b41	dompurify@3.3.3	3.4.6	1
quay.io/hedgedoc/hedgedoc :1.10.8	abdb6b08815d	dompurify@3.4.0	3.4.6	1
quay.io/rht-labs/stack-do500 :3.0.8	6ba82beff18e	dompurify@2.3.1	3.4.6	1
quay.io/wekan/wekan :v5.65	cb17600883a3	dompurify@2.3.3	3.4.6	1