GHSA-6688-9rhm-gjv2
LowAdvisory
Published 5 Oct 2026In the index since 6 Oct 2026
- Severity
- Low
- worst across findings
- CVSS
- 2.0
- base score, highest
- EPSS
- —
- probability of exploitation
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 100
- of 18,026 indexed, latest versions
- Container images
- 87
- deployed by those charts
- Fix available
- 1 of 1
- affected package
DOMPurify: IN_PLACE returns a force-removed rawtext root whose text carries attacker markup — pure HTML reparse executes
Carried by container images the latest versions of 100 of 18,026 indexed charts deploy, on 87 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| dompurifynpm | 1.0.11, 2.1.1, 2.2.6, 2.2.7+32 more | 3.4.16 | 87 |
- OSV records
- GHSA-6688-9rhm-gjv2
Charts affected
100 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| opensearch-dashboardsopensearch-project-helm-chartsVerified publisher | 3.9.0 | 1 of 1See more | 312 |
| wazuhwazuh-helm-morgovedVerified publisher | 2.0.7 | 1 of 5See more | 13,536 |
| homarrhomarr-labsOfficialVerified publisher | 8.32.0 | 1 of 1See more | 359 |
| openclawopenclaw-helmVerified publisher | 1.5.40 | 1 of 2See more | 6,577 |
| outlinekubitodevVerified publisher | 1.2.2 | 1 of 4See more | 6,349 |
| outlineoutline | 0.0.9 | 1 of 4See more | 5,489 |
| krokicowboysysopVerified publisher | 6.1.0 | 1 of 5See more | 8,476 |
| hedgedocadfinisVerified publisher | 0.6.1 | 1 of 2See more | 3,948 |
| docmosthelmforgeVerified publisher | 1.4.0 | 1 of 4See more | 4,620 |
| wazuhwazuh-helmVerified publisher | 0.0.8 | 1 of 4See more | 7,861 |
| wikijsgeek-cookbookVerified publisher | 6.4.2 | 1 of 1See more | 6,275 |
| karakeephelmforgeVerified publisher | 1.2.9 | 1 of 3See more | 11,691 |
| kubernetes-loggingkubernetes-logging | 4.8.0 | 1 of 6See more | 12,012 |
| ghostcloudpirates-ghostVerified publisher | 0.20.28 | 1 of 3See more | 8,355 |
| nightscoutgabe565Verified publisher | 0.13.0 | 1 of 2See more | 2,762 |
| mealiegeek-cookbookVerified publisher | 5.1.2 | 1 of 2See more | 9,161 |
| ghost-on-kubernetesghost-on-kubernetes-helmVerified publisher | 2.0.2 | 1 of 3See more | 1,513 |
| graphql-hivegraphql-hive | 1.0.0 | 1 of 17See more | 12,170 |
| hedgedocrobertobochetVerified publisher | 1.4.0 | 1 of 1See more | 1,450 |
| nocodbzekker6Verified publisher | 1.10.0 | 1 of 1See more | 5,210 |
| siemassist-iot-cybersecurity-monitroting-siem | 0.1.0 | 1 of 3See more | 12,246 |
| opensearch-dashboardscaptnbpVerified publisher | 2.2.1 | 1 of 1See more | 2,045 |
| maildevchristianhuthVerified publisher | 1.6.0 | 1 of 1See more | 1,591 |
| kubedashdevopstalesOfficialVerified publisher | 4.0.0 | 1 of 8See more | 11,978 |
| recipesgeek-cookbookVerified publisher | 6.6.2 | 1 of 2See more | 8,710 |
| ghostgroundhog2k | 0.212.15 | 1 of 1See more | 2,130 |
| plane-enterprisemakeplaneOfficialVerified publisher | 3.10.2 | 1 of 13See more | 6,161 |
| karakeepself-hosters-by-nightVerified publisher | 2.5.1 | 1 of 1See more | 6,068 |
| supabasesupabse | 0.8.0 | 1 of 11See more | 21,495 |
| wikiwenerme | 2.2.0 | 1 of 2See more | 2,599 |
| trifidzazukoOfficialVerified publisher | 0.2.1 | 1 of 1See more | 614 |
| adeptia-automate-mcpadeptia-automate-mcp | 1.0.0 | 1 of 2See more | 4,283 |
| linkwardenadnoctemVerified publisher | 0.5.1 | 1 of 2See more | 4,804 |
| outlineadnoctemVerified publisher | 0.1.2 | 1 of 1See more | 1,993 |
| alluredeckalluredeckVerified publisher | 0.24.0 | 1 of 2See more | 1,705 |
| openapiassist-iot-open-api-management | 0.2.2 | 1 of 6See more | 92,801 |
| opendistro-esbeeinventor | 1.15.1 | 1 of 3See more | 6,098 |
| ghostchart-ghost | 0.1.6 | 1 of 2See more | 1,762 |
| wazuhcsic-charts | 0.1.0 | 1 of 4See more | 15,804 |
| dial-admindialVerified publisher | 0.19.0 | 1 of 3See more | 4,169 |
| adventurelogdjjudas21Verified publisher | 0.1.1 | 1 of 3See more | 9,633 |
| hedgedocernail-hedgedoc | 5.0.0 | 1 of 1See more | 2,147 |
| canary-checkerflanksourceVerified publisher | 1.2.0 | 1 of 2See more | 5,394 |
| facetflanksourceVerified publisher | 0.1.73 | 1 of 1See more | 24,132 |
| flanksource-uiflanksourceVerified publisher | 1.4.321 | 1 of 1See more | 3,263 |
| mission-controlflanksourceVerified publisher | 0.1.338 | 1 of 8See more | 10,885 |
| linkwardenfmjstudios | 0.3.6 | 1 of 2See more | 3,933 |
| nightscoutgeek-cookbookVerified publisher | 1.2.2 | 1 of 1See more | 4,251 |
| redis-uigin | 0.0.1 | 1 of 1See more | 1,397 |
| Governify-Bluejaygovernify | 0.1.0 | 1 of 12See more | 24,071 |
Container images carrying it
87 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| opensearchproject/ | 4bdb8ded547c | dompurify | 3.4.16 | 3 |
| ghcr.io/ | a4a3639899f7 | dompurify | 3.4.16 | 3 |
| quay.io/ | 89bd85d7817f | dompurify | 3.4.16 | 3 |
| amazon/ | c740d7a89475 | dompurify | 3.4.16 | 2 |
| governify/ | 2987672448c7 | dompurify | 3.4.16 | 2 |
| library/ | 428ce627d581 | dompurify | 3.4.16 | 2 |
| opensearchproject/ | 39695180364b | dompurify | 3.4.16 | 2 |
| outlinewiki/ | d060dcd8f9aa | dompurify | 3.4.16 | 2 |
| patrikx3/ | f19eb45b0694 | dompurify | 3.4.16 | 2 |
| requarks/ | fffff288a52f | dompurify | 3.4.16 | 2 |
| adeptiainc/ | 31f295e948e6 | dompurify | 3.4.16 | 1 |
| appwrite/ | 1811ce1d8154 | dompurify | 3.4.16 | 1 |
| archivebox/ | 8c21bb233130 | dompurify | 3.4.16 | 1 |
| assistiot/ | 2297b4350211 | dompurify | 3.4.16 | 1 |
| assistiot/ | f11d82defc70 | dompurify | 3.4.16 | 1 |
| devopsiaci/ | d9441c931f75 | dompurify | 3.4.16 | 1 |
| docmost/ | b56947fcfd08 | dompurify | 3.4.16 | 1 |
| epam/ | 1ecee9f1aa09 | dompurify | 3.4.16 | 1 |
| flanksource/ | 764c84e550db | dompurify | 3.4.16 | 1 |
| flanksource/ | dcc01382340e | dompurify | 3.4.16 | 1 |
| fosrl/ | c32ad797ab96 | dompurify | 3.4.16 | 1 |
| helmforge/ | 70e9143d6d92 | dompurify | 3.4.16 | 1 |
| hkotel/ | 3c04c0e85039 | dompurify | 3.4.16 | 1 |
| infisical/ | 3365445909be | dompurify | 3.4.16 | 1 |
| infisical/ | 6b911e3938ac | dompurify | 3.4.16 | 1 |
| joplin/ | 52af57880c0e | dompurify | 3.4.16 | 1 |
| kyso/ | e52595c5c16f | dompurify | 3.4.16 | 1 |
| library/ | 832e02b53466 | dompurify | 3.4.16 | 1 |
| library/ | 1ef2e532ca4d | dompurify | 3.4.16 | 1 |
| library/ | 2654b1e90413 | dompurify | 3.4.16 | 1 |
| library/ | 29773d6be407 | dompurify | 3.4.16 | 1 |
| library/ | 77196da4b0df | dompurify | 3.4.16 | 1 |
| library/ | 90592b712b6b | dompurify | 3.4.16 | 1 |
| library/ | fea3264f902e | dompurify | 3.4.16 | 1 |
| library/ | 35544f1ff28a | dompurify | 3.4.16 | 1 |
| maildev/ | 180ef51f65ee | dompurify | 3.4.16 | 1 |
| makeplane/ | 3dba6a659fb9 | dompurify | 3.4.16 | 1 |
| nightscout/ | 00c3b4833f1b | dompurify | 3.4.16 | 1 |
| nightscout/ | ad29ca7a4de6 | dompurify | 3.4.16 | 1 |
| nightscout/ | f604dc4c03ca | dompurify | 3.4.16 | 1 |
| nocodb/ | 4ccfc5114506 | dompurify | 3.4.16 | 1 |
| nocodb/ | 6779a4ddedf2 | dompurify | 3.4.16 | 1 |
| nocodb/ | d9516f0bf546 | dompurify | 3.4.16 | 1 |
| opensearchproject/ | 0ecd8444add2 | dompurify | 3.4.16 | 1 |
| opensearchproject/ | 485a0019e5d6 | dompurify | 3.4.16 | 1 |
| opensearchproject/ | b7c26c60bfaf | dompurify | 3.4.16 | 1 |
| outlinewiki/ | 494dfb9249a6 | dompurify | 3.4.16 | 1 |
| outlinewiki/ | 832051f039b4 | dompurify | 3.4.16 | 1 |
| phpdockerio/ | ea8354b42600 | dompurify | 3.4.16 | 1 |
| requarks/ | 8b5865a7386c | dompurify | 3.4.16 | 1 |