https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 13:40:31 +0000 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1049 certfr-2026-avi-1049 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1049 https://cve.radiocsirt.org/vuln/cleanstart-2026-bb38451 <p><strong>Affected:</strong> CleanStart: langfuse-worker</p> <p>Security vulnerability affects the langfuse-worker package. This issue is resolved in later releases. See references for vulnerability details.</p> <p><strong>Affected:</strong> CleanStart: langfuse-worker</p> <p>Security vulnerability affects the langfuse-worker package. This issue is resolved in later releases. See references for vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-bb38451 https://cve.radiocsirt.org/vuln/euvd-2026-340157 EUVD-2026-340157 https://cve.radiocsirt.org/vuln/euvd-2026-340157 https://cve.radiocsirt.org/vuln/fkie_cve-2026-65898 <p>DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute hook, allowing the hook to permanently mutate the shared allowlist. Attackers can register a hook that conditionally allows dangerous attributes like onerror for trusted elements, then submit untrusted content that inherits the polluted allowlist and executes event handlers as stored XSS.</p> <p>DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute hook, allowing the hook to permanently mutate the shared allowlist. Attackers can register a hook that conditionally allows dangerous attributes like onerror for trusted elements, then submit untrusted content that inherits the polluted allowlist and executes event handlers as stored XSS.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-65898 https://cve.radiocsirt.org/vuln/ghsa-cmwh-pvxp-8882 <p><strong>Affected:</strong> npm: dompurify</p> <p>## Summary</p> <p>DOMPurify 3.4.7 shipped a security fix (&#34;permanent hook pollution&#34;) that makes a registered `uponSanitizeAttribute` hook&#39;s mutation of `data.allowedAttributes` **non-persistent** — so allowing an attribute for one element does not leak into later `sanitize()` calls. The fix clones `ALLOWED_ATTR` inside `_parseConfig`.</p> <p>That guard is **silently bypassed whenever the application uses the persistent-config API `DOMPurify.setConfig()`.** `setConfig()` sets the module flag `SET_CONFIG = true`, which causes `sanitize()` to **skip `_parseConfig` entirely** — and the clone-guard lives inside `_parseConfig`. The hook is then handed the **live, shared `ALLOWED_ATTR` object**; any `data.allowedAttributes[name] = true` it writes mutates that shared object **permanently**, for the lifetime of the DOMPurify instance, across every subsequent call, and across **all** elements.</p> <p>If an application uses `setConfig()` together with an `uponSanitizeAttribute` hook that conditionally allows a dangerous attribute (`onerror`, `onclick`, `onmouseover`, `srcdoc`, `formaction`, …) for &#34;trusted&#34; elements, then **one trusted render permanently allows that attribute on untrusted, attacker-controlled content** — yielding stored XSS in viewers&#39; browsers. DOMPurify applies no separate `/^on/` event-handler blocklist: attribute stripping is governed entirely by the allowlist, so a polluted allowlist is the only gate, and survival in the output is final.</p> <p>---</p> <p>## Affected configuration (preconditi…</p> <p><strong>Affected:</strong> npm: dompurify</p> <p>## Summary</p> <p>DOMPurify 3.4.7 shipped a security fix (&#34;permanent hook pollution&#34;) that makes a registered `uponSanitizeAttribute` hook&#39;s mutation of `data.allowedAttributes` **non-persistent** — so allowing an attribute for one element does not leak into later `sanitize()` calls. The fix clones `ALLOWED_ATTR` inside `_parseConfig`.</p> <p>That guard is **silently bypassed whenever the application uses the persistent-config API `DOMPurify.setConfig()`.** `setConfig()` sets the module flag `SET_CONFIG = true`, which causes `sanitize()` to **skip `_parseConfig` entirely** — and the clone-guard lives inside `_parseConfig`. The hook is then handed the **live, shared `ALLOWED_ATTR` object**; any `data.allowedAttributes[name] = true` it writes mutates that shared object **permanently**, for the lifetime of the DOMPurify instance, across every subsequent call, and across **all** elements.</p> <p>If an application uses `setConfig()` together with an `uponSanitizeAttribute` hook that conditionally allows a dangerous attribute (`onerror`, `onclick`, `onmouseover`, `srcdoc`, `formaction`, …) for &#34;trusted&#34; elements, then **one trusted render permanently allows that attribute on untrusted, attacker-controlled content** — yielding stored XSS in viewers&#39; browsers. DOMPurify applies no separate `/^on/` event-handler blocklist: attribute stripping is governed entirely by the allowlist, so a polluted allowlist is the only gate, and survival in the output is final.</p> <p>---</p> <p>## Affected configuration (preconditi…</p> https://cve.radiocsirt.org/vuln/ghsa-cmwh-pvxp-8882 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11723-1 <p>python313-comfyui-frontend-package-1.52.7-1.1 on GA media</p> <p>python313-comfyui-frontend-package-1.52.7-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:11723-1 https://cve.radiocsirt.org/vuln/rhsa-2026:58500 <p>dompurify: DOMPurify: Cross-site scripting via permanent attribute allowlist pollution dompurify: DOMPurify: Client-side arbitrary code execution due to improper Trusted Types policy reset dompurify: DOMPurify: Cross-site scripting vulnerability via attacker-controlled nodeName dompurify: DOMPurify: Sanitization bypass via hook manipulation DOMPurify: DOMPurify: Cross-site scripting due to state leakage in sanitization. dompurify: DOMPurify: URI validation bypass leads to cross-site scripting dompurify: DOMPurify: Cross-Site Scripting (XSS) via prototype pollution in USE_PROFILES mode dompurify: DOMPurify: Cross-Site Scripting vulnerability allows arbitrary code execution</p> <p>dompurify: DOMPurify: Cross-site scripting via permanent attribute allowlist pollution dompurify: DOMPurify: Client-side arbitrary code execution due to improper Trusted Types policy reset dompurify: DOMPurify: Cross-site scripting vulnerability via attacker-controlled nodeName dompurify: DOMPurify: Sanitization bypass via hook manipulation DOMPurify: DOMPurify: Cross-site scripting due to state leakage in sanitization. dompurify: DOMPurify: URI validation bypass leads to cross-site scripting dompurify: DOMPurify: Cross-Site Scripting (XSS) via prototype pollution in USE_PROFILES mode dompurify: DOMPurify: Cross-Site Scripting vulnerability allows arbitrary code execution</p> https://cve.radiocsirt.org/vuln/rhsa-2026:58500 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-65898 <p><strong>Affected:</strong> Ubuntu:22.04:LTS: node-dompurify, Ubuntu:24.04:LTS: node-dompurify, Ubuntu:26.04:LTS: node-dompurify</p> <p>DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute hook, allowing the hook to permanently mutate the shared allowlist. Attackers can register a hook that conditionally allows dangerous attributes like onerror for trusted elements, then submit untrusted content that inherits the polluted allowlist and executes event handlers as stored XSS.</p> <p><strong>Affected:</strong> Ubuntu:22.04:LTS: node-dompurify, Ubuntu:24.04:LTS: node-dompurify, Ubuntu:26.04:LTS: node-dompurify</p> <p>DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute hook, allowing the hook to permanently mutate the shared allowlist. Attackers can register a hook that conditionally allows dangerous attributes like onerror for trusted elements, then submit untrusted content that inherits the polluted allowlist and executes event handlers as stored XSS.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-65898