StackRadar

CVE-2026-65899

Low

Advisory

Published 15 Jun 2026In the index since 6 Sept 2026
Severity
Low
worst across findings
CVSS
2.1
base score, highest
EPSS
0.003
19th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
64
of 17,781 indexed, latest versions
Container images
57
deployed by those charts
Fix available
1 of 1
affected package

DOMPurify: Trusted Types policy survives `clearConfig()` and can poison later `RETURN_TRUSTED_TYPE` output

Carried by container images the latest versions of 64 of 17,781 indexed charts deploy, on 57 images.

Affected packageAffected versionsFixed inImages
dompurifynpm2.1.1, 2.2.6, 2.2.7, 2.3.1+26 more3.4.957
OSV records
GHSA-vxr8-fq34-vvx9

Charts affected

64 by stars
ChartLatestAffected imagesRadar Score
wazuhwazuh-helm-morgovedVerified publisher2.0.71 of 5See more

wazuh wazuh-helm-morgoved 2.0.7

1 of the 5 container images this version deploys carry CVE-2026-65899.

Container imageDigestPackageFixed in
wazuh/wazuh-dashboard:4.14.391e4f0a7feed
dompurify@3.2.4
3.4.9

Open the chart page →

11,384
openclawopenclaw-helmVerified publisher1.5.401 of 2See more

openclaw openclaw-helm 1.5.40

1 of the 2 container images this version deploys carry CVE-2026-65899.

Container imageDigestPackageFixed in
ghcr.io/openclaw/openclaw:2026.5.22dcfd14877740
dompurify@3.4.5
3.4.9

Open the chart page →

5,660
outlineoutline0.0.91 of 4See more

outline outline 0.0.9

1 of the 4 container images this version deploys carry CVE-2026-65899.

Container imageDigestPackageFixed in
outlinewiki/outline:0.69.1d060dcd8f9aa
dompurify@2.4.3
3.4.9

Open the chart page →

4,431
outlinekubitodevVerified publisher1.2.21 of 4See more

outline kubitodev 1.2.2

1 of the 4 container images this version deploys carry CVE-2026-65899.

Container imageDigestPackageFixed in
outlinewiki/outline:0.82.0494dfb9249a6
dompurify@3.2.3
3.4.9

Open the chart page →

5,352
krokicowboysysopVerified publisher6.1.01 of 5See more

kroki cowboysysop 6.1.0

1 of the 5 container images this version deploys carry CVE-2026-65899.

Container imageDigestPackageFixed in
yuzutech/kroki-excalidraw:0.29.157917319ea70
dompurify@3.1.6
3.4.9

Open the chart page →

6,743
wazuhwazuh-helmVerified publisher0.0.81 of 4See more

wazuh wazuh-helm 0.0.8

1 of the 4 container images this version deploys carry CVE-2026-65899.

Container imageDigestPackageFixed in
wazuh/wazuh-dashboard:4.11.10c58e7b47bb6
dompurify@3.1.4
3.4.9

Open the chart page →

6,168
wikijsgeek-cookbookVerified publisher6.4.21 of 1See more

wikijs geek-cookbook 6.4.2

1 of the 1 container images this version deploys carry CVE-2026-65899.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/wikijs:version-2.5.20158d377933678
dompurify@2.2.7
3.4.9

Open the chart page →

5,946
karakeephelmforgeVerified publisher1.2.91 of 3See more

karakeep helmforge 1.2.9

1 of the 3 container images this version deploys carry CVE-2026-65899.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.33.2b069e4307dec
dompurify@3.2.6
3.4.9

Open the chart page →

9,460
kubernetes-loggingkubernetes-logging4.8.01 of 6See more

kubernetes-logging kubernetes-logging 4.8.0

1 of the 6 container images this version deploys carry CVE-2026-65899.

Container imageDigestPackageFixed in
opensearchproject/opensearch-dashboards:2.10.0485a0019e5d6
dompurify@2.4.1
3.4.9

Open the chart page →

10,530
nightscoutgabe565Verified publisher0.13.01 of 2See more

nightscout gabe565 0.13.0

1 of the 2 container images this version deploys carry CVE-2026-65899.

Container imageDigestPackageFixed in
nightscout/cgm-remote-monitor:15.0.2ad29ca7a4de6
dompurify@2.4.3
3.4.9

Open the chart page →

2,521
mealiegeek-cookbookVerified publisher5.1.21 of 2See more

mealie geek-cookbook 5.1.2

1 of the 2 container images this version deploys carry CVE-2026-65899.

Container imageDigestPackageFixed in
hkotel/mealie:frontend-v1.0.0beta-23c04c0e85039
dompurify@2.3.8
3.4.9

Open the chart page →

7,579
graphql-hivegraphql-hive1.0.01 of 17See more

graphql-hive graphql-hive 1.0.0

1 of the 17 container images this version deploys carry CVE-2026-65899.

Container imageDigestPackageFixed in
ghcr.io/kamilkisiela/graphql-hive/app:59b64c36c866b3555c135c70de76a884e63f8619a4a3639899f7
dompurify@2.3.10
3.4.9

Open the chart page →

10,311
nocodbzekker6Verified publisher1.10.01 of 1See more

nocodb zekker6 1.10.0

1 of the 1 container images this version deploys carry CVE-2026-65899.

Container imageDigestPackageFixed in
nocodb/nocodb:0.301.5d9516f0bf546
dompurify@3.3.3
3.4.9

Open the chart page →

4,016
siemassist-iot-cybersecurity-monitroting-siem0.1.01 of 3See more

siem assist-iot-cybersecurity-monitroting-siem 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-65899.

Container imageDigestPackageFixed in
assistiot/cybersecurity-monitoring_id-kbn:latest2297b4350211
dompurify@2.1.1
3.4.9

Open the chart page →

10,730
opensearch-dashboardscaptnbpVerified publisher2.2.11 of 1See more

opensearch-dashboards captnbp 2.2.1

1 of the 1 container images this version deploys carry CVE-2026-65899.

Container imageDigestPackageFixed in
opensearchproject/opensearch-dashboards:2.15.0b7c26c60bfaf
dompurify@2.4.7
3.4.9

Open the chart page →

1,843
maildevchristianhuthVerified publisher1.6.01 of 1See more

maildev christianhuth 1.6.0

1 of the 1 container images this version deploys carry CVE-2026-65899.

Container imageDigestPackageFixed in
maildev/maildev:2.2.1180ef51f65ee
dompurify@3.1.6
3.4.9

Open the chart page →

1,143
joplin-serverdjjudas21Verified publisher5.5.81 of 1See more

joplin-server djjudas21 5.5.8

1 of the 1 container images this version deploys carry CVE-2026-65899.

Container imageDigestPackageFixed in
joplin/server:2.14.2-betab87564ef34e9
dompurify@3.0.5
3.4.9

Open the chart page →

3,925
recipesgeek-cookbookVerified publisher6.6.21 of 2See more

recipes geek-cookbook 6.6.2

1 of the 2 container images this version deploys carry CVE-2026-65899.

Container imageDigestPackageFixed in
vabene1111/recipes:1.0.5.2ec4e9e2905b0
dompurify@2.3.4
3.4.9

Open the chart page →

7,801
karakeepself-hosters-by-nightVerified publisher2.5.11 of 1See more

karakeep self-hosters-by-night 2.5.1

1 of the 1 container images this version deploys carry CVE-2026-65899.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.27.1abd7d6b11b1b
dompurify@3.2.6
3.4.9

Open the chart page →

5,213
wikiwenerme2.2.01 of 2See more

wiki wenerme 2.2.0

1 of the 2 container images this version deploys carry CVE-2026-65899.

Container imageDigestPackageFixed in
requarks/wiki:latest68f0d1848261
dompurify@3.3.1
3.4.9

Open the chart page →

3,833
adeptia-automate-mcpadeptia-automate-mcp1.0.01 of 2See more

adeptia-automate-mcp adeptia-automate-mcp 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-65899.

Container imageDigestPackageFixed in
adeptiainc/adeptia-automate-observe:1.0.031f295e948e6
dompurify@3.3.2
3.4.9

Open the chart page →

3,600
openapiassist-iot-open-api-management0.2.21 of 6See more

openapi assist-iot-open-api-management 0.2.2

1 of the 6 container images this version deploys carry CVE-2026-65899.

Container imageDigestPackageFixed in
assistiot/open_api_frontend:1.0.1f11d82defc70
dompurify@2.3.10
3.4.9

Open the chart page →

18,277
pangolinbdcode0.14.11 of 1See more

pangolin bdcode 0.14.1

1 of the 1 container images this version deploys carry CVE-2026-65899.

Container imageDigestPackageFixed in
fosrl/pangolin:latest83a55f933b4d
dompurify@3.4.0
3.4.9

Open the chart page →

1,901
opendistro-esbeeinventor1.15.11 of 3See more

opendistro-es beeinventor 1.15.1

1 of the 3 container images this version deploys carry CVE-2026-65899.

Container imageDigestPackageFixed in
amazon/opendistro-for-elasticsearch-kibana:1.13.2c740d7a89475
dompurify@2.1.1
3.4.9

Open the chart page →

5,806
ghostchart-ghost0.1.51 of 2See more

ghost chart-ghost 0.1.5

1 of the 2 container images this version deploys carry CVE-2026-65899.

Container imageDigestPackageFixed in
library/ghost:6.22.0-alpine3.23ac533a6988ee
dompurify@3.3.0
3.4.9

Open the chart page →

4,083
wazuhcsic-charts0.1.01 of 4See more

wazuh csic-charts 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-65899.

Container imageDigestPackageFixed in
wazuh/wazuh-dashboard:4.4.11787550d2358
dompurify@2.4.1
3.4.9

Open the chart page →

13,852
adventurelogdjjudas21Verified publisher0.1.11 of 3See more

adventurelog djjudas21 0.1.1

1 of the 3 container images this version deploys carry CVE-2026-65899.

Container imageDigestPackageFixed in
ghcr.io/seanmorley15/adventurelog-frontend:v0.13.051ee22428b41
dompurify@3.3.3
3.4.9

Open the chart page →

7,459
hedgedocernail-hedgedoc5.0.01 of 1See more

hedgedoc ernail-hedgedoc 5.0.0

1 of the 1 container images this version deploys carry CVE-2026-65899.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.10.8abdb6b08815d
dompurify@3.4.0
3.4.9

Open the chart page →

1,755
canary-checkerflanksourceVerified publisher1.2.01 of 2See more

canary-checker flanksource 1.2.0

1 of the 2 container images this version deploys carry CVE-2026-65899.

Container imageDigestPackageFixed in
flanksource/canary-checker-ui:v1.4.281764c84e550db
dompurify@3.2.6
3.4.9

Open the chart page →

4,650
nightscoutgeek-cookbookVerified publisher1.2.21 of 1See more

nightscout geek-cookbook 1.2.2

1 of the 1 container images this version deploys carry CVE-2026-65899.

Container imageDigestPackageFixed in
nightscout/cgm-remote-monitor:14.2.500c3b4833f1b
dompurify@2.2.6
3.4.9

Open the chart page →

4,043
Governify-Bluejaygovernify0.1.01 of 12See more

Governify-Bluejay governify 0.1.0

1 of the 12 container images this version deploys carry CVE-2026-65899.

Container imageDigestPackageFixed in
governify/assets-manager:v1.4.12987672448c7
dompurify@2.2.6
3.4.9

Open the chart page →

22,512
Governify-Falcongovernify0.1.01 of 10See more

Governify-Falcon governify 0.1.0

1 of the 10 container images this version deploys carry CVE-2026-65899.

Container imageDigestPackageFixed in
governify/assets-manager:v1.4.12987672448c7
dompurify@2.2.6
3.4.9

Open the chart page →

24,319
hive-appgraphql-hive1.0.01 of 1See more

hive-app graphql-hive 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-65899.

Container imageDigestPackageFixed in
ghcr.io/kamilkisiela/graphql-hive/app:59b64c36c866b3555c135c70de76a884e63f8619a4a3639899f7
dompurify@2.3.10
3.4.9

Open the chart page →

2,682
hive-appgraphql-hive-subcharts1.0.01 of 1See more

hive-app graphql-hive-subcharts 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-65899.

Container imageDigestPackageFixed in
ghcr.io/kamilkisiela/graphql-hive/app:59b64c36c866b3555c135c70de76a884e63f8619a4a3639899f7
dompurify@2.3.10
3.4.9

Open the chart page →

2,682
archiveboxhelmforgeVerified publisher1.1.121 of 1See more

archivebox helmforge 1.1.12

1 of the 1 container images this version deploys carry CVE-2026-65899.

Container imageDigestPackageFixed in
archivebox/archivebox:0.7.41a5a37331091
dompurify@3.0.7
3.4.9

Open the chart page →

7,633
self-learning-platformhelm-self-learning-platformVerified publisher1.1.01 of 1See more

self-learning-platform helm-self-learning-platform 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-65899.

Container imageDigestPackageFixed in
devopsiaci/self-learning-platform:1.1.3d9441c931f75
dompurify@3.2.7
3.4.9

Open the chart page →

1,468
wikijshomeenterpriseinc1.4.01 of 1See more

wikijs homeenterpriseinc 1.4.0

1 of the 1 container images this version deploys carry CVE-2026-65899.

Container imageDigestPackageFixed in
requarks/wiki:canary-2.5.2438b5865a7386c
dompurify@2.2.7
3.4.9

Open the chart page →

4,253
nocodbinseefrlab0.2.01 of 1See more

nocodb inseefrlab 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-65899.

Container imageDigestPackageFixed in
nocodb/nocodb:latest4b760f0d2547
dompurify@3.4.8
3.4.9

Open the chart page →

781
ghostjanip81-helm-chartsVerified publisher0.1.21 of 1See more

ghost janip81-helm-charts 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-65899.

Container imageDigestPackageFixed in
library/ghost:6.37.01ef2e532ca4d
dompurify@3.4.1
3.4.9

Open the chart page →

3,436
ghostk8s-home-lab-repo4.1.01 of 1See more

ghost k8s-home-lab-repo 4.1.0

1 of the 1 container images this version deploys carry CVE-2026-65899.

Container imageDigestPackageFixed in
library/ghost:6.41.129773d6be407
dompurify@3.4.1
3.4.9

Open the chart page →

3,092
pangolinkrzwiatrzyk0.11.01 of 1See more

pangolin krzwiatrzyk 0.11.0

1 of the 1 container images this version deploys carry CVE-2026-65899.

Container imageDigestPackageFixed in
fosrl/pangolin:1.13.0c32ad797ab96
dompurify@3.2.7
3.4.9

Open the chart page →

3,441
ghostkubernetes-homelab-helm-chartsVerified publisher0.1.21 of 2See more

ghost kubernetes-homelab-helm-charts 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-65899.

Container imageDigestPackageFixed in
library/ghost:6.39.0-alpine77196da4b0df
dompurify@3.4.1
3.4.9

Open the chart page →

2,756
kyso-frontkyso1.0.01 of 1See more

kyso-front kyso 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-65899.

Container imageDigestPackageFixed in
kyso/kyso-front:lateste52595c5c16f
dompurify@2.3.10
3.4.9

Open the chart page →

2,685
aws-api-gateway-operatormintel0.1.21 of 11See more

aws-api-gateway-operator mintel 0.1.2

1 of the 11 container images this version deploys carry CVE-2026-65899.

Container imageDigestPackageFixed in
opensearchproject/opensearch-dashboards:1.0.039695180364b
dompurify@2.1.1
3.4.9

Open the chart page →

10,603
standard-application-stackmintel11.4.01 of 12See more

standard-application-stack mintel 11.4.0

1 of the 12 container images this version deploys carry CVE-2026-65899.

Container imageDigestPackageFixed in
opensearchproject/opensearch-dashboards:1.0.039695180364b
dompurify@2.1.1
3.4.9

Open the chart page →

10,603
ghostmt1905028.25.11 of 3See more

ghost mt190502 8.25.1

1 of the 3 container images this version deploys carry CVE-2026-65899.

Container imageDigestPackageFixed in
library/ghost:6.25.12654b1e90413
dompurify@3.3.0
3.4.9

Open the chart page →

4,960
nightscoutmt1905021.1.01 of 3See more

nightscout mt190502 1.1.0

1 of the 3 container images this version deploys carry CVE-2026-65899.

Container imageDigestPackageFixed in
nightscout/cgm-remote-monitor:15.0.3f604dc4c03ca
dompurify@2.4.3
3.4.9

Open the chart page →

6,608
nocodbone-acre-fundVerified publisher0.4.61 of 3See more

nocodb one-acre-fund 0.4.6

1 of the 3 container images this version deploys carry CVE-2026-65899.

Container imageDigestPackageFixed in
nocodb/nocodb:0.258.06779a4ddedf2
dompurify@3.2.0
3.4.9

Open the chart page →

4,219
readability-js-serverreadability-js-server0.1.01 of 1See more

readability-js-server readability-js-server 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-65899.

Container imageDigestPackageFixed in
phpdockerio/readability-js-server:1.8.0ea8354b42600
dompurify@3.3.1
3.4.9

Open the chart page →

1,858
stackrox-chartredhat-cop0.0.101 of 1See more

stackrox-chart redhat-cop 0.0.10

1 of the 1 container images this version deploys carry CVE-2026-65899.

Container imageDigestPackageFixed in
quay.io/rht-labs/stack-do500:3.0.86ba82beff18e
dompurify@2.3.1
3.4.9

Open the chart page →

29,227

Container images carrying it

57 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/kamilkisiela/graphql-hive/app:59b64c36c866b3555c135c70de76a884e63f8619a4a3639899f7
dompurify@2.3.10
3.4.9
3
amazon/opendistro-for-elasticsearch-kibana:1.13.2c740d7a89475
dompurify@2.1.1
3.4.9
2
governify/assets-manager:v1.4.12987672448c7
dompurify@2.2.6
3.4.9
2
opensearchproject/opensearch-dashboards:1.0.039695180364b
dompurify@2.1.1
3.4.9
2
outlinewiki/outline:0.69.1d060dcd8f9aa
dompurify@2.4.3
3.4.9
2
requarks/wiki:2:latest68f0d1848261
dompurify@3.3.1
3.4.9
2
adeptiainc/adeptia-automate-observe:1.0.031f295e948e6
dompurify@3.3.2
3.4.9
1
archivebox/archivebox:0.7.41a5a37331091
dompurify@3.0.7
3.4.9
1
assistiot/cybersecurity-monitoring_id-kbn:latest2297b4350211
dompurify@2.1.1
3.4.9
1
assistiot/open_api_frontend:1.0.1f11d82defc70
dompurify@2.3.10
3.4.9
1
devopsiaci/self-learning-platform:1.1.3d9441c931f75
dompurify@3.2.7
3.4.9
1
flanksource/canary-checker-ui:v1.4.281764c84e550db
dompurify@3.2.6
3.4.9
1
fosrl/pangolin:latest83a55f933b4d
dompurify@3.4.0
3.4.9
1
fosrl/pangolin:1.13.0c32ad797ab96
dompurify@3.2.7
3.4.9
1
hkotel/mealie:frontend-v1.0.0beta-23c04c0e85039
dompurify@2.3.8
3.4.9
1
joplin/server:3.0-beta52af57880c0e
dompurify@3.0.5
3.4.9
1
joplin/server:2.14.2-betab87564ef34e9
dompurify@3.0.5
3.4.9
1
kyso/kyso-front:lateste52595c5c16f
dompurify@2.3.10
3.4.9
1
library/ghost:6.37.01ef2e532ca4d
dompurify@3.4.1
3.4.9
1
library/ghost:6.25.12654b1e90413
dompurify@3.3.0
3.4.9
1
library/ghost:6.41.129773d6be407
dompurify@3.4.1
3.4.9
1
library/ghost:6.39.0-alpine77196da4b0df
dompurify@3.4.1
3.4.9
1
library/ghost:6.22.0-alpine3.23ac533a6988ee
dompurify@3.3.0
3.4.9
1
maildev/maildev:2.2.1180ef51f65ee
dompurify@3.1.6
3.4.9
1
nightscout/cgm-remote-monitor:14.2.500c3b4833f1b
dompurify@2.2.6
3.4.9
1
nightscout/cgm-remote-monitor:15.0.2ad29ca7a4de6
dompurify@2.4.3
3.4.9
1
nightscout/cgm-remote-monitor:15.0.3f604dc4c03ca
dompurify@2.4.3
3.4.9
1
nocodb/nocodb:latest4b760f0d2547
dompurify@3.4.8
3.4.9
1
nocodb/nocodb:0.258.06779a4ddedf2
dompurify@3.2.0
3.4.9
1
nocodb/nocodb:0.301.5d9516f0bf546
dompurify@3.3.3
3.4.9
1
opensearchproject/opensearch-dashboards:2.18.00ecd8444add2
dompurify@2.5.6
3.4.9
1
opensearchproject/opensearch-dashboards:2.10.0485a0019e5d6
dompurify@2.4.1
3.4.9
1
opensearchproject/opensearch-dashboards:2.15.0b7c26c60bfaf
dompurify@2.4.7
3.4.9
1
outlinewiki/outline:0.82.0494dfb9249a6
dompurify@3.2.3
3.4.9
1
phpdockerio/readability-js-server:1.8.0ea8354b42600
dompurify@3.3.1
3.4.9
1
requarks/wiki:canary-2.5.2438b5865a7386c
dompurify@2.2.7
3.4.9
1
speckle/speckle-frontend-2:2.20.2-branch.testing4.134160-9fad4b210ad4ade8bf2
dompurify@3.0.11
3.4.9
1
speckle/speckle-frontend-2:2.20.6-branch.testing1.154030-9b0911432fc940d9b4c
dompurify@3.0.11
3.4.9
1
speckle/speckle-frontend-2:2.19.2-branch.hotfix-2.19.1.124125-665e7e14f9241665ae3
dompurify@3.0.11
3.4.9
1
speckle/speckle-frontend-2:2.21.3-branch.testing5.219631-2153befd4ca6ebf09b9
dompurify@3.0.11
3.4.9
1
speckle/speckle-frontend-2:2.20.3-branch.hotfix-2.20.2.149555-37ea0cbfdc008effc7a
dompurify@3.0.11
3.4.9
1
vabene1111/recipes:1.0.5.2ec4e9e2905b0
dompurify@2.3.4
3.4.9
1
wazuh/wazuh-dashboard:4.11.10c58e7b47bb6
dompurify@3.1.4
3.4.9
1
wazuh/wazuh-dashboard:4.4.11787550d2358
dompurify@2.4.1
3.4.9
1
wazuh/wazuh-dashboard:4.14.491c8d793746f
dompurify@3.2.4
3.4.9
1
wazuh/wazuh-dashboard:4.14.391e4f0a7feed
dompurify@3.2.4
3.4.9
1
yuzutech/kroki-excalidraw:0.29.157917319ea70
dompurify@3.1.6
3.4.9
1
zimengxiong/excalidash-backend:0.4.271273af713c91
dompurify@3.3.0
3.4.9
1
ghcr.io/karakeep-app/karakeep:0.27.1abd7d6b11b1b
dompurify@3.2.6
3.4.9
1
ghcr.io/karakeep-app/karakeep:0.33.2b069e4307dec
dompurify@3.2.6
3.4.9
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.