CVE-2026-65901

Low

Advisory

Published 15 Jun 2026In the index since 6 Sept 2026

Severity: Low; worst across findings
CVSS: 2.0; base score, highest
EPSS: 0.002; 9th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 63; of 17,781 indexed, latest versions
Container images: 56; deployed by those charts
Fix available: None; affected package

DOMPurify: `IN_PLACE` mode trusts attacker-controlled `nodeName` on live non-form nodes, allowing script retention and XSS via attacker-supplied DOM objects

Carried by container images the latest versions of 63 of 17,781 indexed charts deploy, on 56 images.

Affected package	Affected versions	Fixed in	Images
dompurifynpm	2.1.1, 2.2.6, 2.2.7, 2.3.1+25 more	no fix listed	56

OSV records: GHSA-x4vx-rjvf-j5p4

Charts affected

63 by stars

Chart

Latest

Affected images

Radar Score

joplinrubxkube

1.3.1

1 of 2 See more

joplin rubxkube 1.3.1

1 of the 2 container images this version deploys carry CVE-2026-65901.

Container image	Digest	Package	Fixed in
joplin/server :3.0-beta	52af57880c0e	dompurify@3.0.5	no fix listed

Open the chart page →

7,413

outlineschmitzis

0.0.8

1 of 4 See more

outline schmitzis 0.0.8

1 of the 4 container images this version deploys carry CVE-2026-65901.

Container image	Digest	Package	Fixed in
outlinewiki/outline :0.69.1	d060dcd8f9aa	dompurify@2.4.3	no fix listed

Open the chart page →

4,431

wekanschmitzis

1.1.1

1 of 1 See more

wekan schmitzis 1.1.1

1 of the 1 container images this version deploys carry CVE-2026-65901.

Container image	Digest	Package	Fixed in
quay.io/wekan/wekan :v5.65	cb17600883a3	dompurify@2.3.3	no fix listed

Open the chart page →

3,638

speckle-server-branch-hotfix-2.19.1speckle

2.19.2-branch.hotfix-2.19.1.124125-665e7e1

1 of 5 See more

speckle-server-branch-hotfix-2.19.1 speckle 2.19.2-branch.hotfix-2.19.1.124125-665e7e1

1 of the 5 container images this version deploys carry CVE-2026-65901.

Container image	Digest	Package	Fixed in
speckle/speckle-frontend-2 :2.19.2-branch.hotfix-2.19.1.124125-665e7e1	4f9241665ae3	dompurify@3.0.11	no fix listed

Open the chart page →

16,368

speckle-server-branch-hotfix-2.20.2speckle

2.20.3-branch.hotfix-2.20.2.149555-37ea0cb

1 of 5 See more

speckle-server-branch-hotfix-2.20.2 speckle 2.20.3-branch.hotfix-2.20.2.149555-37ea0cb

1 of the 5 container images this version deploys carry CVE-2026-65901.

Container image	Digest	Package	Fixed in
speckle/speckle-frontend-2 :2.20.3-branch.hotfix-2.20.2.149555-37ea0cb	fdc008effc7a	dompurify@3.0.11	no fix listed

Open the chart page →

16,400

speckle-server-branch-testing1speckle

2.20.6-branch.testing1.154030-9b09114

1 of 5 See more

speckle-server-branch-testing1 speckle 2.20.6-branch.testing1.154030-9b09114

1 of the 5 container images this version deploys carry CVE-2026-65901.

Container image	Digest	Package	Fixed in
speckle/speckle-frontend-2 :2.20.6-branch.testing1.154030-9b09114	32fc940d9b4c	dompurify@3.0.11	no fix listed

Open the chart page →

16,400

speckle-server-branch-testing4speckle

2.20.2-branch.testing4.134160-9fad4b2

1 of 5 See more

speckle-server-branch-testing4 speckle 2.20.2-branch.testing4.134160-9fad4b2

1 of the 5 container images this version deploys carry CVE-2026-65901.

Container image	Digest	Package	Fixed in
speckle/speckle-frontend-2 :2.20.2-branch.testing4.134160-9fad4b2	10ad4ade8bf2	dompurify@3.0.11	no fix listed

Open the chart page →

16,019

speckle-server-branch-testing5speckle

2.21.3-branch.testing5.219631-2153bef

1 of 5 See more

speckle-server-branch-testing5 speckle 2.21.3-branch.testing5.219631-2153bef

1 of the 5 container images this version deploys carry CVE-2026-65901.

Container image	Digest	Package	Fixed in
speckle/speckle-frontend-2 :2.21.3-branch.testing5.219631-2153bef	d4ca6ebf09b9	dompurify@3.0.11	no fix listed

Open the chart page →

15,635

excalidashunxwares

2026.2.5

1 of 2 See more

excalidash unxwares 2026.2.5

1 of the 2 container images this version deploys carry CVE-2026-65901.

Container image	Digest	Package	Fixed in
zimengxiong/excalidash-backend :0.4.27	1273af713c91	dompurify@3.3.0	no fix listed

Open the chart page →

2,620

wazuhwazuh-helm-eks

1.2.10

1 of 6 See more

wazuh wazuh-helm-eks 1.2.10

1 of the 6 container images this version deploys carry CVE-2026-65901.

Container image	Digest	Package	Fixed in
wazuh/wazuh-dashboard :4.14.4	91c8d793746f	dompurify@3.2.4	no fix listed

Open the chart page →

5,484

wikiwikijs

3.0.0

1 of 2 See more

wiki wikijs 3.0.0

1 of the 2 container images this version deploys carry CVE-2026-65901.

Container image	Digest	Package	Fixed in
requarks/wiki :2	68f0d1848261	dompurify@3.3.1	no fix listed

Open the chart page →

5,459

opendistro-eswitcom-gmbh

1.13.3

1 of 3 See more

opendistro-es witcom-gmbh 1.13.3

1 of the 3 container images this version deploys carry CVE-2026-65901.

Container image	Digest	Package	Fixed in
amazon/opendistro-for-elasticsearch-kibana :1.13.2	c740d7a89475	dompurify@2.1.1	no fix listed

Open the chart page →

5,806

ygdrassil-monitoringygdrassil

0.4.0

1 of 10 See more

ygdrassil-monitoring ygdrassil 0.4.0

1 of the 10 container images this version deploys carry CVE-2026-65901.

Container image	Digest	Package	Fixed in
opensearchproject/opensearch-dashboards :2.18.0	0ecd8444add2	dompurify@2.5.6	no fix listed

Open the chart page →

9,381

Container images carrying it

56 by charts deploying them

A fixed version is listed for 0 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/linuxserver/wikijs :version-2.5.201	58d377933678	dompurify@2.2.7	no fix listed	1
ghcr.io/openclaw/openclaw :2026.5.22	dcfd14877740	dompurify@3.4.5	no fix listed	1
ghcr.io/seanmorley15/adventurelog-frontend :v0.13.0	51ee22428b41	dompurify@3.3.3	no fix listed	1
quay.io/hedgedoc/hedgedoc :1.10.8	abdb6b08815d	dompurify@3.4.0	no fix listed	1
quay.io/rht-labs/stack-do500 :3.0.8	6ba82beff18e	dompurify@2.3.1	no fix listed	1
quay.io/wekan/wekan :v5.65	cb17600883a3	dompurify@2.3.3	no fix listed	1