StackRadar

GHSA-p98j-92pf-mc4p

Low

Advisory

Published 30 Sept 2026In the index since 1 Oct 2026
Severity
Low
worst across findings
CVSS
2.3
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
30
of 17,966 indexed, latest versions
Container images
26
deployed by those charts
Fix available
1 of 1
affected package

DOMPurify: IN_PLACE: node-removing afterSanitize hook leaves detached subtree event handlers armed, causing DOM XSS

Carried by container images the latest versions of 30 of 17,966 indexed charts deploy, on 26 images.

Affected packageAffected versionsFixed inImages
dompurifynpm3.4.13, 3.4.14, 3.4.153.4.1626
OSV records
GHSA-p98j-92pf-mc4p

Charts affected

30 by stars
ChartLatestAffected imagesRadar Score
opensearch-dashboardsopensearch-project-helm-chartsVerified publisher3.9.01 of 1See more

opensearch-dashboards opensearch-project-helm-charts 3.9.0

1 of the 1 container images this version deploys carry GHSA-p98j-92pf-mc4p.

Container imageDigestPackageFixed in
opensearchproject/opensearch-dashboards:3.9.04bdb8ded547c
dompurify@3.4.13
3.4.16

Open the chart page →

250
oneuptimeoneuptimeOfficialVerified publisher14.0.103 of 7See more

oneuptime oneuptime 14.0.10

3 of the 7 container images this version deploys carry GHSA-p98j-92pf-mc4p.

Container imageDigestPackageFixed in
oneuptime/nginx:release50a0b6b3b161
dompurify@3.4.15
3.4.16
oneuptime/probe:release2a29fe29ddc8
dompurify@3.4.15
3.4.16
oneuptime/runner:release65ffc551c71d
dompurify@3.4.15
3.4.16

Open the chart page →

9,051
wekanwekanVerified publisher12.12.01 of 3See more

wekan wekan 12.12.0

1 of the 3 container images this version deploys carry GHSA-p98j-92pf-mc4p.

Container imageDigestPackageFixed in
ghcr.io/wekan/wekan:v12.12fae2454cbad7
dompurify@3.4.15
3.4.16

Open the chart page →

1,678
hedgedocadfinisVerified publisher0.6.11 of 2See more

hedgedoc adfinis 0.6.1

1 of the 2 container images this version deploys carry GHSA-p98j-92pf-mc4p.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.12.089bd85d7817f
dompurify@3.4.14
3.4.16

Open the chart page →

3,626
docmosthelmforgeVerified publisher1.4.01 of 4See more

docmost helmforge 1.4.0

1 of the 4 container images this version deploys carry GHSA-p98j-92pf-mc4p.

Container imageDigestPackageFixed in
docmost/docmost:0.96.0b56947fcfd08
dompurify@3.4.13
3.4.16

Open the chart page →

4,260
ghostcloudpirates-ghostVerified publisher0.20.261 of 3See more

ghost cloudpirates-ghost 0.20.26

1 of the 3 container images this version deploys carry GHSA-p98j-92pf-mc4p.

Container imageDigestPackageFixed in
library/ghost:6.64.0586821cfebac
dompurify@3.4.13
3.4.16

Open the chart page →

7,893
ghost-on-kubernetesghost-on-kubernetes-helmVerified publisher1.1.21 of 3See more

ghost-on-kubernetes ghost-on-kubernetes-helm 1.1.2

1 of the 3 container images this version deploys carry GHSA-p98j-92pf-mc4p.

Container imageDigestPackageFixed in
ghcr.io/sredevopsorg/ghost-on-kubernetes:main06adb21bfdfc
dompurify@3.4.13
3.4.16

Open the chart page →

1,965
hedgedocrobertobochetVerified publisher1.4.01 of 1See more

hedgedoc robertobochet 1.4.0

1 of the 1 container images this version deploys carry GHSA-p98j-92pf-mc4p.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.12.089bd85d7817f
dompurify@3.4.14
3.4.16

Open the chart page →

1,378
kubedashdevopstalesOfficialVerified publisher4.0.01 of 8See more

kubedash devopstales 4.0.0

1 of the 8 container images this version deploys carry GHSA-p98j-92pf-mc4p.

Container imageDigestPackageFixed in
patrikx3/p3x-redis-ui:latestf19eb45b0694
dompurify@3.4.14
3.4.16

Open the chart page →

10,177
ghostgroundhog2k0.212.141 of 1See more

ghost groundhog2k 0.212.14

1 of the 1 container images this version deploys carry GHSA-p98j-92pf-mc4p.

Container imageDigestPackageFixed in
library/ghost:6.65.090592b712b6b
dompurify@3.4.13
3.4.16

Open the chart page →

2,467
plane-enterprisemakeplaneOfficialVerified publisher3.10.21 of 13See more

plane-enterprise makeplane 3.10.2

1 of the 13 container images this version deploys carry GHSA-p98j-92pf-mc4p.

Container imageDigestPackageFixed in
makeplane/space-commercial:v3.3.03dba6a659fb9
dompurify@3.4.13
3.4.16

Open the chart page →

4,608
linkwardenadnoctemVerified publisher0.5.11 of 2See more

linkwarden adnoctem 0.5.1

1 of the 2 container images this version deploys carry GHSA-p98j-92pf-mc4p.

Container imageDigestPackageFixed in
ghcr.io/linkwarden/linkwarden:v2.16.30664c28a039b
dompurify@3.4.14
3.4.16

Open the chart page →

4,474
outlineadnoctemVerified publisher0.1.21 of 1See more

outline adnoctem 0.1.2

1 of the 1 container images this version deploys carry GHSA-p98j-92pf-mc4p.

Container imageDigestPackageFixed in
outlinewiki/outline:1.10.1832051f039b4
dompurify@3.4.13
3.4.16

Open the chart page →

1,875
excalidashalekcVerified publisher1.4.01 of 2See more

excalidash alekc 1.4.0

1 of the 2 container images this version deploys carry GHSA-p98j-92pf-mc4p.

Container imageDigestPackageFixed in
zimengxiong/excalidash-backend:0.6.0cbdab75f31b2
dompurify@3.4.14
3.4.16

Open the chart page →

1,126
ghostchart-ghost0.1.61 of 2See more

ghost chart-ghost 0.1.6

1 of the 2 container images this version deploys carry GHSA-p98j-92pf-mc4p.

Container imageDigestPackageFixed in
library/ghost:6.65.0-alpine3.23fea3264f902e
dompurify@3.4.13
3.4.16

Open the chart page →

1,440
dial-admindialVerified publisher0.19.01 of 3See more

dial-admin dial 0.19.0

1 of the 3 container images this version deploys carry GHSA-p98j-92pf-mc4p.

Container imageDigestPackageFixed in
epam/ai-dial-admin-frontend:0.21.01ecee9f1aa09
dompurify@3.4.13
3.4.16

Open the chart page →

4,032
facetflanksourceVerified publisher0.1.731 of 1See more

facet flanksource 0.1.73

1 of the 1 container images this version deploys carry GHSA-p98j-92pf-mc4p.

Container imageDigestPackageFixed in
ghcr.io/flanksource/facet:0.1.73a0323f4283e5
dompurify@3.4.15
3.4.16

Open the chart page →

23,496
redis-uigin0.0.11 of 1See more

redis-ui gin 0.0.1

1 of the 1 container images this version deploys carry GHSA-p98j-92pf-mc4p.

Container imageDigestPackageFixed in
patrikx3/p3x-redis-ui:latestf19eb45b0694
dompurify@3.4.14
3.4.16

Open the chart page →

1,329
ghosthelmforgeVerified publisher1.2.101 of 3See more

ghost helmforge 1.2.10

1 of the 3 container images this version deploys carry GHSA-p98j-92pf-mc4p.

Container imageDigestPackageFixed in
library/ghost:6.65.090592b712b6b
dompurify@3.4.13
3.4.16

Open the chart page →

2,978
strapihelmforgeVerified publisher2.3.151 of 3See more

strapi helmforge 2.3.15

1 of the 3 container images this version deploys carry GHSA-p98j-92pf-mc4p.

Container imageDigestPackageFixed in
helmforge/strapi-base:5.52.270e9143d6d92
dompurify@3.4.13
3.4.16

Open the chart page →

2,206
twentyhelmforgeVerified publisher1.0.31 of 5See more

twenty helmforge 1.0.3

1 of the 5 container images this version deploys carry GHSA-p98j-92pf-mc4p.

Container imageDigestPackageFixed in
twentycrm/twenty:v2.43.0b2b662b1bef1
dompurify@3.4.13
3.4.16

Open the chart page →

2,763
infisicalinfisical-charts0.4.21 of 3See more

infisical infisical-charts 0.4.2

1 of the 3 container images this version deploys carry GHSA-p98j-92pf-mc4p.

Container imageDigestPackageFixed in
infisical/infisical:latest3365445909be
dompurify@3.4.14
3.4.16

Open the chart page →

3,223
nocodbinseefrlab0.2.01 of 1See more

nocodb inseefrlab 0.2.0

1 of the 1 container images this version deploys carry GHSA-p98j-92pf-mc4p.

Container imageDigestPackageFixed in
nocodb/nocodb:latest4ccfc5114506
dompurify@3.4.13
3.4.16

Open the chart page →

743
hedgedocsi-gitops0.12.31 of 2See more

hedgedoc si-gitops 0.12.3

1 of the 2 container images this version deploys carry GHSA-p98j-92pf-mc4p.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.12.089bd85d7817f
dompurify@3.4.14
3.4.16

Open the chart page →

3,322
infisicalsinextraVerified publisher0.6.01 of 1See more

infisical sinextra 0.6.0

1 of the 1 container images this version deploys carry GHSA-p98j-92pf-mc4p.

Container imageDigestPackageFixed in
infisical/infisical:v0.165.602082bf13163
dompurify@3.4.14
3.4.16

Open the chart page →

3,871
supabaseteochenglim0.1.21 of 13See more

supabase teochenglim 0.1.2

1 of the 13 container images this version deploys carry GHSA-p98j-92pf-mc4p.

Container imageDigestPackageFixed in
supabase/studio:latestfdb56cfa1705
dompurify@3.4.13
3.4.16

Open the chart page →

10,026
twenty-crmvictorlane0.0.11 of 3See more

twenty-crm victorlane 0.0.1

1 of the 3 container images this version deploys carry GHSA-p98j-92pf-mc4p.

Container imageDigestPackageFixed in
twentycrm/twenty:latest47bcefe4e497
dompurify@3.4.13
3.4.16

Open the chart page →

73,602
opensearch-dashboardswener3.9.01 of 1See more

opensearch-dashboards wener 3.9.0

1 of the 1 container images this version deploys carry GHSA-p98j-92pf-mc4p.

Container imageDigestPackageFixed in
opensearchproject/opensearch-dashboards:3.9.04bdb8ded547c
dompurify@3.4.13
3.4.16

Open the chart page →

250
opensearch-dashboardswenerme3.9.01 of 1See more

opensearch-dashboards wenerme 3.9.0

1 of the 1 container images this version deploys carry GHSA-p98j-92pf-mc4p.

Container imageDigestPackageFixed in
opensearchproject/opensearch-dashboards:3.9.04bdb8ded547c
dompurify@3.4.13
3.4.16

Open the chart page →

250
kibanawiremindVerified publisher8.5.241 of 2See more

kibana wiremind 8.5.24

1 of the 2 container images this version deploys carry GHSA-p98j-92pf-mc4p.

Container imageDigestPackageFixed in
library/kibana:8.19.2235544f1ff28a
dompurify@3.4.14
3.4.16

Open the chart page →

1,611

Container images carrying it

26 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
opensearchproject/opensearch-dashboards:3.9.04bdb8ded547c
dompurify@3.4.13
3.4.16
3
quay.io/hedgedoc/hedgedoc:1.12.089bd85d7817f
dompurify@3.4.14
3.4.16
3
library/ghost:6.65.090592b712b6b
dompurify@3.4.13
3.4.16
2
patrikx3/p3x-redis-ui:latestf19eb45b0694
dompurify@3.4.14
3.4.16
2
docmost/docmost:0.96.0b56947fcfd08
dompurify@3.4.13
3.4.16
1
epam/ai-dial-admin-frontend:0.21.01ecee9f1aa09
dompurify@3.4.13
3.4.16
1
helmforge/strapi-base:5.52.270e9143d6d92
dompurify@3.4.13
3.4.16
1
infisical/infisical:latest:v0.165.602082bf13163
dompurify@3.4.14
3.4.16
1
infisical/infisical:latest3365445909be
dompurify@3.4.14
3.4.16
1
library/ghost:6.64.0586821cfebac
dompurify@3.4.13
3.4.16
1
library/ghost:6.65.0-alpine3.23fea3264f902e
dompurify@3.4.13
3.4.16
1
library/kibana:8.19.2235544f1ff28a
dompurify@3.4.14
3.4.16
1
makeplane/space-commercial:v3.3.03dba6a659fb9
dompurify@3.4.13
3.4.16
1
nocodb/nocodb:latest4ccfc5114506
dompurify@3.4.13
3.4.16
1
oneuptime/nginx:release50a0b6b3b161
dompurify@3.4.15
3.4.16
1
oneuptime/probe:release2a29fe29ddc8
dompurify@3.4.15
3.4.16
1
oneuptime/runner:release65ffc551c71d
dompurify@3.4.15
3.4.16
1
outlinewiki/outline:1.10.1832051f039b4
dompurify@3.4.13
3.4.16
1
supabase/studio:latestfdb56cfa1705
dompurify@3.4.13
3.4.16
1
twentycrm/twenty:latest:v2.41.047bcefe4e497
dompurify@3.4.13
3.4.16
1
twentycrm/twenty:v2.43.0b2b662b1bef1
dompurify@3.4.13
3.4.16
1
zimengxiong/excalidash-backend:0.6.0cbdab75f31b2
dompurify@3.4.14
3.4.16
1
ghcr.io/flanksource/facet:0.1.73a0323f4283e5
dompurify@3.4.15
3.4.16
1
ghcr.io/linkwarden/linkwarden:v2.16.30664c28a039b
dompurify@3.4.14
3.4.16
1
ghcr.io/sredevopsorg/ghost-on-kubernetes:main06adb21bfdfc
dompurify@3.4.13
3.4.16
1
ghcr.io/wekan/wekan:v12.12fae2454cbad7
dompurify@3.4.15
3.4.16
1

syft 1.42.1 · advisories as of 1 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.