CVE-2026-65900 vulnerabilities

Vulnerabilities for packages: langfuse, kibana, wazuh-dashboard-fips, nextcloud-server, langfuse-fips, wazuh-dashboard, librechat...

CVE-2026-65900

creationtimestamp| type| source ---|---|--- 2026-07-23 16:35:23+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-gvmj-g25r-r7wr...

CVE-2026-65900

DOMPurify versions =3.0.0 and before 3.4.8, when configured with SAFEFORTEMPLATES together with a DOM output mode RETURNDOM, RETURNDOMFRAGMENT, or INPLACE, fail to strip template expressions e.g. $evil, evil, inside element content. The final normalization/scrub pass scrubTemplateExpressions uses...

CVE-2026-65900 DOMPurify before 3.4.8 Template Expression Injection via RETURN_DOM

DOMPurify versions =3.0.0 and before 3.4.8, when configured with SAFEFORTEMPLATES together with a DOM output mode RETURNDOM, RETURNDOMFRAGMENT, or INPLACE, fail to strip template expressions e.g. $evil, evil, inside element content. The final normalization/scrub pass scrubTemplateExpressions uses...

CVE-2026-65900

DOMPurify versions =3.0.0 and before 3.4.8, when configured with SAFEFORTEMPLATES together with a DOM output mode RETURNDOM, RETURNDOMFRAGMENT, or INPLACE, fail to strip template expressions e.g. $evil, evil, inside element content. The final normalization/scrub pass scrubTemplateExpressions uses...

CVE-2026-65900

CVE-2026-65900 affects DOMPurify versions 3.0.0 up to 3.4.7 when configured with SAFE_FOR_TEMPLATES and a DOM output mode (RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE). The final scrub pass (_scrubTemplateExpressions) uses a NodeIterator and node.normalize() that do not descend into template.con...

1router (>=0.3.96, <=1.0.2), 8router (>=0.5.12, <=0.5.24) +2162 more potentially affected by CVE-2026-65900 via dompurify (>=3.0.0, <=3.4.7)

dompurify NPM version =3.0.0, =0.3.96, =0.5.12, =0.3.33, =0.5.0, =0.4.71, =1.0.0, =1.5.1, =0.18.0-beta.0, =0.1.0-alpha.1, =0.1.0, =0.1.0, =0.0.0-dev-20240828032938, =0.2.8-experimental.0, =0.2.10 and more Source cves: CVE-2026-65900 Source advisory: OSV:GHSA-GVMJ-G25R-R7WR...