Copyright © 2012 Red Hat, Inc. All rights reserved.
Important
2026-07-14T20:02:46
dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution
8.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
CWE-79
DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.7, DOMPurify IN_PLACE sanitization could skip shadow contents attached to an element inside <template>.content, allowing attacker-controlled markup such as event handlers, JavaScript URLs, or scripts to survive and execute when an application cloned and inserted the sanitized template. This issue is fixed in version 3.4.7.
A flaw was found in DOMPurify, a tool designed to sanitize HTML, MathML, and SVG to prevent cross-site scripting (XSS) attacks. When performing in-place sanitization, DOMPurify could fail to properly process content within shadow DOM elements attached to a <template>.content. This oversight allows an attacker to embed malicious code, such as JavaScript, which could then execute when the sanitized template is used by an application, potentially leading to unauthorized actions or information disclosure.
This vulnerability in DOMPurify is rated as Important as it allows for cross-site scripting (XSS) attacks. When DOMPurify performs in-place sanitization, it may fail to properly process shadow DOM content within `<template>.content`, enabling an attacker to embed and execute malicious JavaScript. This could lead to unauthorized actions or information disclosure in Red Hat products that utilize DOMPurify for sanitizing untrusted HTML, MathML, or SVG.
Red Hat Advanced Cluster Security 4.9
2026-07-30T00:00:00Z
RHSA-2026:48872
advanced-cluster-security/rhacs-main-rhel8:1785413210
Red Hat Advanced Cluster Security for Kubernetes 4.10
2026-07-30T00:00:00Z
RHSA-2026:48913
advanced-cluster-security/rhacs-main-rhel8:1785420959
Red Hat Advanced Cluster Security for Kubernetes 4.11
2026-07-30T00:00:00Z
RHSA-2026:48891
advanced-cluster-security/rhacs-main-rhel9:1785415868
Red Hat Ansible Automation Platform 2.2
2026-07-21T00:00:00Z
RHSA-2026:42815
ansible-automation-platform/automation-portal:1784622951
Red Hat Container Native Virtualization 4.12
2026-07-27T00:00:00Z
RHSA-2026:46623
container-native-virtualization/kubevirt-console-plugin:1784710594
Red Hat Container Native Virtualization 4.14
2026-07-27T00:00:00Z
RHSA-2026:46539
container-native-virtualization/kubevirt-console-plugin-rhel9:1784741686
Red Hat Container Native Virtualization 4.17
2026-07-27T00:00:00Z
RHSA-2026:46558
container-native-virtualization/kubevirt-console-plugin-rhel9:1784805322
Red Hat Container Native Virtualization 4.22
2026-07-22T00:00:00Z
RHSA-2026:43625
container-native-virtualization/kubevirt-console-plugin-rhel9:1784634128
Red Hat Developer Hub 1.10
2026-07-29T00:00:00Z
RHSA-2026:48126
rhdh/red-hat-developer-hub-backstage-plugin-lightspeed:1785333413
Cryostat 4
Affected
cryostat-openshift-console-plugin-npm
Cryostat 4
Affected
dompurify
Cryostat 4
Affected
grafana-infinity-datasource-npm
Migration Toolkit for Virtualization
Affected
migration-toolkit-virtualization/mtv-console-plugin-rhel9
Multicluster Engine for Kubernetes
Not affected
multicluster-engine/console-mce-rhel9
Node HealthCheck Operator
Affected
workload-availability/node-healthcheck-must-gather-rhel9
Node HealthCheck Operator
Affected
workload-availability/node-healthcheck-operator-bundle
Node HealthCheck Operator
Affected
workload-availability/node-healthcheck-rhel9-operator
OpenShift Lightspeed
Not affected
openshift-lightspeed/lightspeed-agentic-console-rhel9
OpenShift Lightspeed
Not affected
openshift-lightspeed/lightspeed-console-plugin-419-rhel9
OpenShift Lightspeed
Not affected
openshift-lightspeed/lightspeed-console-plugin-pf5-rhel9
OpenShift Lightspeed
Not affected
openshift-lightspeed/lightspeed-console-plugin-rhel9
OpenShift Service Mesh 3
Affected
openshift-service-mesh/kiali-ossmc-rhel9
OpenShift Service Mesh 3
Affected
openshift-service-mesh/kiali-rhel9
Red Hat 3scale API Management Platform 2
Affected
3scale-amp21/system
Red Hat 3scale API Management Platform 2
Affected
3scale-amp22/system
Red Hat 3scale API Management Platform 2
Affected
3scale-amp2/system-rhel7
Red Hat 3scale API Management Platform 2
Affected
3scale-amp2/system-rhel8
Red Hat 3scale API Management Platform 2
Affected
3scale-amp2/system-rhel9
Red Hat Advanced Cluster Management for Kubernetes 2
Not affected
rhacm2/console-rhel9
Red Hat AMQ Broker 7
Affected
dompurify
Red Hat Ansible Automation Platform 2
Affected
ansible-automation-platform-26/gateway-rhel9
Red Hat Ansible Automation Platform 2
Affected
ansible-automation-platform-27/gateway-rhel9
Red Hat Ansible Automation Platform 2
Not affected
automation-controller
Red Hat Ansible Automation Platform 2
Affected
automation-eda-controller
Red Hat Ansible Automation Platform 2
Affected
automation-gateway
Red Hat Ansible Automation Platform 2
Affected
automation-platform-ui
Red Hat build of Apache Camel for Spring Boot 4
Not affected
dompurify
Red Hat build of Apache Camel - HawtIO 4
Affected
dompurify
Red Hat build of Apicurio Registry 3
Affected
apicurio/apicurio-registry-ui-rhel8
Red Hat build of Apicurio Registry 3
Affected
apicurio/apicurio-registry-ui-rhel9
Red Hat Build of Podman Desktop
Affected
rh-podman-desktop.git
Red Hat Ceph Storage 9
Fix deferred
rhceph/alloy-rhel10
Red Hat Data Grid 8
Affected
dompurify
Red Hat Enterprise Linux 10
Not affected
grafana
Red Hat Enterprise Linux 10
Not affected
grafana-pcp
Red Hat Enterprise Linux 8
Not affected
grafana
Red Hat Enterprise Linux 9
Not affected
grafana
Red Hat Hardened Images
Affected
ruff
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-dashboard-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-mod-arch-automl-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-mod-arch-autorag-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-mod-arch-eval-hub-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-mod-arch-gen-ai-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-mod-arch-maas-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-mod-arch-mlflow-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-mod-arch-model-registry-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9
Red Hat OpenShift Container Platform 4
Affected
openshift4/ose-agent-installer-ui-rhel9
Red Hat OpenShift Container Platform 4
Affected
openshift4/ose-console
Red Hat OpenShift Container Platform 4
Affected
openshift4/ose-console-rhel9
Red Hat OpenShift Container Platform 4
Not affected
openshift4/ose-monitoring-plugin-rhel8
Red Hat OpenShift Container Platform 4
Affected
openshift4/ose-monitoring-plugin-rhel9
Red Hat Openshift Data Foundation 4
Not affected
odf4/ocs-client-console-rhel9
Red Hat Openshift Data Foundation 4
Affected
odf4/odf-console-rhel9
Red Hat Openshift Data Foundation 4
Fix deferred
odf4/odf-multicluster-console-rhel9
Red Hat OpenShift Dev Spaces
Affected
devspaces/code-rhel9
Red Hat OpenShift Dev Spaces
Affected
devspaces/openvsx-rhel9
Red Hat OpenShift GitOps
Affected
openshift-gitops-1/argocd-rhel8
Red Hat OpenShift GitOps
Affected
openshift-gitops-1/argocd-rhel9
streams for Apache Kafka 2
Affected
dompurify
streams for Apache Kafka 3
Affected
dompurify
https://www.cve.org/CVERecord?id=CVE-2026-49978
https://nvd.nist.gov/vuln/detail/CVE-2026-49978
https://github.com/cure53/DOMPurify/commit/ca30f070c360df162a3e3848e80e6fd3c9e74bff
https://github.com/cure53/DOMPurify/releases/tag/3.4.7
https://github.com/cure53/DOMPurify/security/advisories/GHSA-rp9w-3fw7-7cwq