StackRadar

GHSA-c6gr-qvv4-5v3f

Low

Advisory

Published 22 Oct 2026In the index since 23 Oct 2026
Severity
Low
worst across findings
CVSS
2.0
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
111
of 18,232 indexed, latest versions
Container images
97
deployed by those charts
Fix available
1 of 1
affected package

DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml

Carried by container images the latest versions of 111 of 18,232 indexed charts deploy, on 97 images.

Affected packageAffected versionsFixed inImages
dompurifynpm1.0.11, 2.1.1, 2.2.6, 2.2.7+34 more3.4.1797
OSV records
GHSA-c6gr-qvv4-5v3f

Charts affected

111 by stars
ChartLatestAffected imagesRadar Score
excalidashunxwaresVerified publisher2026.10.11 of 2See more

excalidash unxwares 2026.10.1

1 of the 2 container images this version deploys carry GHSA-c6gr-qvv4-5v3f.

Container imageDigestPackageFixed in
zimengxiong/excalidash-backend:0.6.529937c62fbed
dompurify@3.4.16
3.4.17

Open the chart page →

594
kenerunxwaresVerified publisher2026.10.11 of 2See more

kener unxwares 2026.10.1

1 of the 2 container images this version deploys carry GHSA-c6gr-qvv4-5v3f.

Container imageDigestPackageFixed in
rajnandan1/kener:4.1.7-alpined920a2b71c20
dompurify@3.3.3
3.4.17

Open the chart page →

1,989
twenty-crmvictorlane0.0.11 of 3See more

twenty-crm victorlane 0.0.1

1 of the 3 container images this version deploys carry GHSA-c6gr-qvv4-5v3f.

Container imageDigestPackageFixed in
twentycrm/twenty:latest7ea7839b8945
dompurify@3.4.13
3.4.17

Open the chart page →

72,635
wazuhwazuh-helm-eksVerified publisher1.2.101 of 6See more

wazuh wazuh-helm-eks 1.2.10

1 of the 6 container images this version deploys carry GHSA-c6gr-qvv4-5v3f.

Container imageDigestPackageFixed in
wazuh/wazuh-dashboard:4.14.491c8d793746f
dompurify@3.2.4
3.4.17

Open the chart page →

7,539
opensearch-dashboardswener3.9.01 of 1See more

opensearch-dashboards wener 3.9.0

1 of the 1 container images this version deploys carry GHSA-c6gr-qvv4-5v3f.

Container imageDigestPackageFixed in
opensearchproject/opensearch-dashboards:3.9.04bdb8ded547c
dompurify@3.4.13
3.4.17

Open the chart page →

408
wikiwener2.2.01 of 2See more

wiki wener 2.2.0

1 of the 2 container images this version deploys carry GHSA-c6gr-qvv4-5v3f.

Container imageDigestPackageFixed in
requarks/wiki:latestfffff288a52f
dompurify@3.3.1
3.4.17

Open the chart page →

2,652
opensearch-dashboardswenerme3.9.01 of 1See more

opensearch-dashboards wenerme 3.9.0

1 of the 1 container images this version deploys carry GHSA-c6gr-qvv4-5v3f.

Container imageDigestPackageFixed in
opensearchproject/opensearch-dashboards:3.9.04bdb8ded547c
dompurify@3.4.13
3.4.17

Open the chart page →

408
wikiwikijs3.0.01 of 2See more

wiki wikijs 3.0.0

1 of the 2 container images this version deploys carry GHSA-c6gr-qvv4-5v3f.

Container imageDigestPackageFixed in
requarks/wiki:2fffff288a52f
dompurify@3.3.1
3.4.17

Open the chart page →

4,389
kibanawiremindVerified publisher8.5.241 of 2See more

kibana wiremind 8.5.24

1 of the 2 container images this version deploys carry GHSA-c6gr-qvv4-5v3f.

Container imageDigestPackageFixed in
library/kibana:8.19.224116dd6a5838
dompurify@3.4.14
3.4.17

Open the chart page →

1,757
opendistro-eswitcom-gmbh1.13.31 of 3See more

opendistro-es witcom-gmbh 1.13.3

1 of the 3 container images this version deploys carry GHSA-c6gr-qvv4-5v3f.

Container imageDigestPackageFixed in
amazon/opendistro-for-elasticsearch-kibana:1.13.2c740d7a89475
dompurify@2.1.1
3.4.17

Open the chart page →

6,103
ygdrassil-monitoringygdrassilVerified publisher0.4.01 of 10See more

ygdrassil-monitoring ygdrassil 0.4.0

1 of the 10 container images this version deploys carry GHSA-c6gr-qvv4-5v3f.

Container imageDigestPackageFixed in
opensearchproject/opensearch-dashboards:2.18.00ecd8444add2
dompurify@2.5.6
3.4.17

Open the chart page →

14,060

Container images carrying it

97 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
opensearchproject/opensearch-dashboards:2.18.00ecd8444add2
dompurify@2.5.6
3.4.17
1
opensearchproject/opensearch-dashboards:2.10.0485a0019e5d6
dompurify@2.4.1
3.4.17
1
opensearchproject/opensearch-dashboards:2.15.0b7c26c60bfaf
dompurify@2.4.7
3.4.17
1
opensign/opensign0ebc230eed21
dompurify@3.4.13
3.4.17
1
outlinewiki/outline:1.11.008ee9ffdb847
dompurify@3.4.16
3.4.17
1
outlinewiki/outline:0.82.0494dfb9249a6
dompurify@3.2.3
3.4.17
1
phpdockerio/readability-js-server:1.8.0ea8354b42600
dompurify@3.3.1
3.4.17
1
rajnandan1/kener:4.1.7-alpined920a2b71c20
dompurify@3.3.3
3.4.17
1
requarks/wiki:canary-2.5.2438b5865a7386c
dompurify@2.2.7
3.4.17
1
speckle/speckle-frontend-2:2.20.2-branch.testing4.134160-9fad4b210ad4ade8bf2
dompurify@3.0.11
3.4.17
1
speckle/speckle-frontend-2:2.20.6-branch.testing1.154030-9b0911432fc940d9b4c
dompurify@3.0.11
3.4.17
1
speckle/speckle-frontend-2:2.19.2-branch.hotfix-2.19.1.124125-665e7e14f9241665ae3
dompurify@3.0.11
3.4.17
1
speckle/speckle-frontend-2:2.21.3-branch.testing5.219631-2153befd4ca6ebf09b9
dompurify@3.0.11
3.4.17
1
speckle/speckle-frontend-2:2.20.3-branch.hotfix-2.20.2.149555-37ea0cbfdc008effc7a
dompurify@3.0.11
3.4.17
1
supabase/studio:2026.08.03-sha-022b374606aca9fdaa7
dompurify@3.4.12
3.4.17
1
supabase/studio:latestd878dcd9dba7
dompurify@3.4.13
3.4.17
1
twentycrm/twenty:latest7ea7839b8945
dompurify@3.4.13
3.4.17
1
twentycrm/twenty:v2.49.080e1b33b0b4b
dompurify@3.4.16
3.4.17
1
twentycrm/twenty:v2.22.0e7d9948bf284
dompurify@3.4.11
3.4.17
1
vabene1111/recipes:1.0.5.2ec4e9e2905b0
dompurify@2.3.4
3.4.17
1
wazuh/wazuh-dashboard:4.11.10c58e7b47bb6
dompurify@3.1.4
3.4.17
1
wazuh/wazuh-dashboard:4.4.11787550d2358
dompurify@2.4.1
3.4.17
1
wazuh/wazuh-dashboard:4.14.491c8d793746f
dompurify@3.2.4
3.4.17
1
wazuh/wazuh-dashboard:4.14.391e4f0a7feed
dompurify@3.2.4
3.4.17
1
yuzutech/kroki-excalidraw:0.33.0f6ed8589e7f5
dompurify@3.4.12
3.4.17
1
zimengxiong/excalidash-backend:0.6.529937c62fbed
dompurify@3.4.16
3.4.17
1
ghcr.io/flanksource/facet:0.1.73a0323f4283e5
dompurify@3.4.12
3.4.17
1
ghcr.io/homarr-labs/homarr:v2.6.01e077fc77d3a
dompurify@3.4.11
3.4.17
1
ghcr.io/homarr-labs/homarr:v1.77.2d60120a04536
dompurify@3.4.11
3.4.17
1
ghcr.io/homarr-labs/homarr:v2.7.0f532ce7cb2a3
dompurify@3.4.11
3.4.17
1
ghcr.io/karakeep-app/karakeep:0.34.0151cdd6b5f2e
dompurify@3.4.16
3.4.17
1
ghcr.io/karakeep-app/karakeep:0.27.1abd7d6b11b1b
dompurify@3.2.6
3.4.17
1
ghcr.io/karakeep-app/karakeep:0.26.0f575a34ed3f8
dompurify@3.2.6
3.4.17
1
ghcr.io/linkwarden/linkwarden:v2.16.30664c28a039b
dompurify@3.4.14
3.4.17
1
ghcr.io/linkwarden/linkwarden:v2.5.398214faf09f7
dompurify@3.0.6
3.4.17
1
ghcr.io/linuxserver/wikijs:version-2.5.20158d377933678
dompurify@2.2.7
3.4.17
1
ghcr.io/lockdep/stackradar-client:0.2.01ef6c7132778
dompurify@3.4.16
3.4.17
1
ghcr.io/openclaw/openclaw:2026.5.22dcfd14877740
dompurify@3.4.5
3.4.17
1
ghcr.io/openclaw/openclaw:2026.10.5:latestf40d1e66fd14
dompurify@3.4.16
3.4.17
1
ghcr.io/quenchworks/images/friendica70d5535c83f0
dompurify@3.4.16
3.4.17
1
ghcr.io/seanmorley15/adventurelog-frontend:v0.13.051ee22428b41
dompurify@3.3.3
3.4.17
1
ghcr.io/sredevopsorg/ghost-on-kubernetes:main305999dea18a
dompurify@3.4.16
3.4.17
1
ghcr.io/zazuko/trifid:v6.0.159bda2bf65d4
dompurify@3.4.9
3.4.17
1
quay.io/hedgedoc/hedgedoc:1.12.089bd85d7817f
dompurify@3.4.14
3.4.17
1
quay.io/hedgedoc/hedgedoc:1.10.8abdb6b08815d
dompurify@3.4.0
3.4.17
1
quay.io/rht-labs/stack-do500:3.0.86ba82beff18e
dompurify@2.3.1
3.4.17
1
quay.io/wekan/wekan:v5.65cb17600883a3
dompurify@2.3.3
3.4.17
1

syft 1.42.1 · advisories as of 23 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.