GHSA-cg2g-xh64-v4q7
CriticalAdvisory
Published 22 Oct 2026In the index since 23 Oct 2026
- Severity
- Critical
- worst across findings
- CVSS
- 9.2
- base score, highest
- EPSS
- —
- probability of exploitation
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 53
- of 18,232 indexed, latest versions
- Container images
- 47
- deployed by those charts
- Fix available
- 1 of 1
- affected package
DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes
Carried by container images the latest versions of 53 of 18,232 indexed charts deploy, on 47 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| dompurifynpm | 3.4.5, 3.4.8, 3.4.9, 3.4.11+4 more | 3.4.17 | 47 |
- OSV records
- GHSA-cg2g-xh64-v4q7
Charts affected
53 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| opensearch-dashboardsopensearch-project-helm-chartsVerified publisher | 3.9.0 | 1 of 1See more | 408 |
| homarrhomarr-labsOfficialVerified publisher | 8.37.0 | 1 of 1See more | 218 |
| oneuptimeoneuptimeOfficialVerified publisher | 14.0.85 | 3 of 7See more | 9,101 |
| openclawopenclaw-helmVerified publisher | 1.5.40 | 1 of 2See more | 6,758 |
| apim3graviteeioVerified publisher | 4.13.0 | 1 of 4See more | 4,610 |
| krokicowboysysopVerified publisher | 6.2.0 | 1 of 5See more | 2,799 |
| hedgedocadfinisVerified publisher | 0.6.1 | 1 of 2See more | 5,498 |
| docmosthelmforgeVerified publisher | 1.4.4 | 1 of 4See more | 4,686 |
| karakeephelmforgeVerified publisher | 1.2.11 | 1 of 3See more | 10,843 |
| ghostcloudpirates-ghostVerified publisher | 0.20.32 | 1 of 3See more | 8,837 |
| ghost-on-kubernetesghost-on-kubernetes-helmVerified publisher | 2.0.2 | 1 of 3See more | 1,663 |
| apimgraviteeioVerified publisher | 4.13.0 | 1 of 4See more | 4,610 |
| hedgedocrobertobochetVerified publisher | 1.4.0 | 1 of 1See more | 2,825 |
| betterdb-monitorbetterdb-monitorOfficialVerified publisher | 0.51.1 | 1 of 1See more | 391 |
| kubedashdevopstalesOfficialVerified publisher | 4.0.0 | 1 of 8See more | 12,937 |
| ghostgroundhog2k | 0.212.18 | 1 of 1See more | 1,993 |
| stackradarlockdepVerified publisher | 0.2.0 | 1 of 4See more | 5,899 |
| plane-enterprisemakeplaneOfficialVerified publisher | 3.10.12 | 1 of 13See more | 7,522 |
| openclawopenclaw-helm-chartVerified publisher | 1.0.70 | 1 of 3See more | 2,205 |
| supabasesupabse | 0.8.0 | 1 of 11See more | 55,104 |
| trifidzazukoOfficialVerified publisher | 0.2.1 | 1 of 1See more | 663 |
| linkwardenadnoctemVerified publisher | 0.5.1 | 1 of 2See more | 5,027 |
| outlineadnoctemVerified publisher | 0.1.3 | 1 of 1See more | 1,641 |
| openclawcabrera-evil-chartsVerified publisher | 0.1.1 | 1 of 1See more | 2,268 |
| ghostchart-ghost | 0.1.7 | 1 of 2See more | 1,253 |
| dial-admindialVerified publisher | 0.20.0 | 1 of 3See more | 3,715 |
| openclaweasy-openclaw | 0.1.0 | 1 of 1See more | 2,205 |
| facetflanksourceVerified publisher | 0.1.73 | 1 of 1See more | 29,698 |
| flanksource-uiflanksourceVerified publisher | 1.4.354 | 1 of 1See more | 3,559 |
| mission-controlflanksourceVerified publisher | 0.1.339 | 1 of 8See more | 11,832 |
| redis-uigin | 0.0.1 | 1 of 1See more | 1,469 |
| appwritehelmforgeVerified publisher | 2.0.7 | 1 of 5See more | 4,412 |
| ghosthelmforgeVerified publisher | 1.2.13 | 1 of 3See more | 2,901 |
| homarrhelmforgeVerified publisher | 1.2.14 | 1 of 1See more | 218 |
| opensignhelmforgeVerified publisher | 1.0.0 | 1 of 3See more | 69,398 |
| strapihelmforgeVerified publisher | 2.3.17 | 1 of 3See more | 2,610 |
| twentyhelmforgeVerified publisher | 1.0.9 | 1 of 5See more | 2,903 |
| self-learning-platformhelm-self-learning-platformVerified publisher | 1.1.2 | 1 of 1See more | 721 |
| infisicalinfisical-charts | 0.4.2 | 1 of 3See more | 2,596 |
| infisical-standaloneinfisical-charts | 1.11.1 | 1 of 5See more | 2,596 |
| nocodbinseefrlab | 0.2.0 | 1 of 1See more | 421 |
| ghostkubernetes-homelab-helm-chartsVerified publisher | 0.3.0 | 1 of 2See more | 2,050 |
| homarrmedia-servarrVerified publisher | 0.56.0 | 1 of 1See more | 864 |
| friendicaquench-friendicaVerified publisher | 0.0.4 | 1 of 2See more | 101 |
| hedgedocsi-gitops | 0.12.3 | 1 of 2See more | 3,946 |
| infisicalsinextraVerified publisher | 0.7.2 | 1 of 1See more | 3,219 |
| supabaseteochenglim | 0.1.2 | 1 of 13See more | 32,654 |
| twentytwenty-crm | 0.1.11 | 1 of 4See more | 6,880 |
| excalidashunxwaresVerified publisher | 2026.10.1 | 1 of 2See more | 594 |
| twenty-crmvictorlane | 0.0.1 | 1 of 3See more | 72,635 |
Container images carrying it
47 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| opensearchproject/ | 4bdb8ded547c | dompurify | 3.4.17 | 3 |
| graviteeio/ | 32440f832842 | dompurify | 3.4.17 | 2 |
| infisical/ | dbc5be2079b6 | dompurify | 3.4.17 | 2 |
| library/ | 00032f157262 | dompurify | 3.4.17 | 2 |
| patrikx3/ | f19eb45b0694 | dompurify | 3.4.17 | 2 |
| ghcr.io/ | 7dbff0fe5f53 | dompurify | 3.4.17 | 2 |
| quay.io/ | cd66986a2a49 | dompurify | 3.4.17 | 2 |
| appwrite/ | b16ee4e5c19c | dompurify | 3.4.17 | 1 |
| betterdb/ | c4910692b3fc | dompurify | 3.4.17 | 1 |
| devopsiaci/ | b295edf28f1c | dompurify | 3.4.17 | 1 |
| docmost/ | b56947fcfd08 | dompurify | 3.4.17 | 1 |
| epam/ | 7bceacad3de2 | dompurify | 3.4.17 | 1 |
| flanksource/ | 2bb089c79fc0 | dompurify | 3.4.17 | 1 |
| flanksource/ | 8d17f0c08b20 | dompurify | 3.4.17 | 1 |
| helmforge/ | 5a6c2c449840 | dompurify | 3.4.17 | 1 |
| infisical/ | bb8352b71cea | dompurify | 3.4.17 | 1 |
| library/ | 8e07c5ec63d9 | dompurify | 3.4.17 | 1 |
| library/ | c0d83a8d4522 | dompurify | 3.4.17 | 1 |
| library/ | db4c56c196d6 | dompurify | 3.4.17 | 1 |
| library/ | 4116dd6a5838 | dompurify | 3.4.17 | 1 |
| makeplane/ | c4a6236c4080 | dompurify | 3.4.17 | 1 |
| nocodb/ | 27d2fd14670d | dompurify | 3.4.17 | 1 |
| oneuptime/ | 63187e1d5121 | dompurify | 3.4.17 | 1 |
| oneuptime/ | 9502ee0cf3f5 | dompurify | 3.4.17 | 1 |
| oneuptime/ | 73130c0cb328 | dompurify | 3.4.17 | 1 |
| opensign/ | 0ebc230eed21 | dompurify | 3.4.17 | 1 |
| outlinewiki/ | 08ee9ffdb847 | dompurify | 3.4.17 | 1 |
| supabase/ | 606aca9fdaa7 | dompurify | 3.4.17 | 1 |
| supabase/ | d878dcd9dba7 | dompurify | 3.4.17 | 1 |
| twentycrm/ | 7ea7839b8945 | dompurify | 3.4.17 | 1 |
| twentycrm/ | 80e1b33b0b4b | dompurify | 3.4.17 | 1 |
| twentycrm/ | e7d9948bf284 | dompurify | 3.4.17 | 1 |
| yuzutech/ | f6ed8589e7f5 | dompurify | 3.4.17 | 1 |
| zimengxiong/ | 29937c62fbed | dompurify | 3.4.17 | 1 |
| ghcr.io/ | a0323f4283e5 | dompurify | 3.4.17 | 1 |
| ghcr.io/ | 1e077fc77d3a | dompurify | 3.4.17 | 1 |
| ghcr.io/ | d60120a04536 | dompurify | 3.4.17 | 1 |
| ghcr.io/ | f532ce7cb2a3 | dompurify | 3.4.17 | 1 |
| ghcr.io/ | 151cdd6b5f2e | dompurify | 3.4.17 | 1 |
| ghcr.io/ | 0664c28a039b | dompurify | 3.4.17 | 1 |
| ghcr.io/ | 1ef6c7132778 | dompurify | 3.4.17 | 1 |
| ghcr.io/ | dcfd14877740 | dompurify | 3.4.17 | 1 |
| ghcr.io/ | f40d1e66fd14 | dompurify | 3.4.17 | 1 |
| ghcr.io/ | 70d5535c83f0 | dompurify | 3.4.17 | 1 |
| ghcr.io/ | 305999dea18a | dompurify | 3.4.17 | 1 |
| ghcr.io/ | 59bda2bf65d4 | dompurify | 3.4.17 | 1 |
| quay.io/ | 89bd85d7817f | dompurify | 3.4.17 | 1 |