{"id":"CVE-2025-26791","aliases":["CLSA-2026-1774398077","CLSA-2026-1774398078","CLSA-2026-1774398080","CLSA-2026-1774743817","CLSA-2026-1774743830","CLSA-2026-1778201083","CLSA-2026-1778805976","CLSA-2026-1780274966","CLSA-2026-1780361389","CLSA-2026-1786539981","CLSA-2026-1786636600","CLSA-2026-1786636613","CLSA-2026-1786636721","CLSA-2026-1786731948","CLSA-2026-1792155851","CLSA-2026-1792156267","CLSA-2026-1792156282","CLSA-2026-1792156382","CLSA-2026-1792156589","CLSA-2026-1792156694","CLSA-2026-1792156909","CLSA-2026-1792157013","CLSA-2026-1792157113","CLSA-2026-1792161408","CLSA-2026-1792369452","CLSA-2026-1792424449","CLSA-2026-1792424891","CLSA-2026-1792601061","CLSA-2026-1793101871","CLSA-2026-1793102041","DEBIAN-CVE-2025-26791","EUVD-2025-4245","GHSA-2cf5-4w76-r9qv","GHSA-g9r4-xpmj-mj65","GHSA-q2c6-c6pm-g3gh","GHSA-q42p-pg8m-cqh6","GHSA-vhxf-7vqr-mrjg","RHSA-2026:2769","ROOT-APP-NPM-CVE-2025-26791","ROOT-APP-NPM-GHSA-2cf5-4w76-r9qv","ROOT-APP-NPM-GHSA-g9r4-xpmj-mj65","ROOT-APP-NPM-GHSA-q2c6-c6pm-g3gh","ROOT-APP-NPM-GHSA-q42p-pg8m-cqh6","UBUNTU-CVE-2025-26791","openSUSE-SU-2025:14921-1"],"status":"published","title":"Arbitrary Code Execution in handlebars","description":"DOMPurify before 3.2.4 has an incorrect template literal regular expression, sometimes leading to mutation cross-site scripting (mXSS).","severity":{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00605,"percentile":0.49468,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1321","CWE-471","CWE-79","CWE-94"],"published":"2019-06-05T14:07:48Z","modified":"2026-11-05T13:28:25Z","fixes":[{"ecosystem":"npm","package":"handlebars","fixed_in":["3.0.8","4.5.2","4.5.3","4.1.2","4.0.14","3.0.7"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"dompurify","fixed_in":["3.2.4"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"dompurify","fixed_in":["2.5.8-tuxcare.1","3.1.6-tuxcare.1"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"handlebars","fixed_in":["1.3.0-tuxcare.1","1.0.12-tuxcare.2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-dompurify","fixed_in":["3.1.7+dfsg+~3.0.5-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-dompurify","fixed_in":["3.1.7+dfsg+~3.0.5-2"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"dompurify","fixed_in":["2.5.8-aikido.3","2.5.9-aikido.1","2.5.8-aikido.1","2.5.9-aikido.2","2.5.9-aikido.3","2.5.8-aikido.2","2.5.9-aikido.4","2.5.9-aikido.5","3.2.4-aikido.1","3.2.4-aikido.2","3.2.4-aikido.3","3.2.4-aikido.4","3.2.4-aikido.5"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/dompurify","fixed_in":["2.5.8-root.io.3","2.5.9-root.io.1","2.5.8-root.io.1","2.5.9-root.io.2","2.5.9-root.io.3","2.5.8-root.io.2","2.5.9-root.io.4","2.5.9-root.io.5","3.2.4-root.io.1","3.2.4-root.io.2","3.2.4-root.io.3","3.2.4-root.io.4","3.2.4-root.io.5"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"handlebars","fixed_in":["3.0.7-aikido.3","3.0.3-aikido.2","3.0.8-aikido.1","3.0.8-aikido.2","3.0.7-aikido.1","3.0.7-aikido.2"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/handlebars","fixed_in":["3.0.7-root.io.3","3.0.3-root.io.2","3.0.8-root.io.1","3.0.8-root.io.2","3.0.7-root.io.1","3.0.7-root.io.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"argocd-cli","fixed_in":["2.14.8-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8"}]}]},{"source":"ghsa","ecosystem":"npm","package":"handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.5.2"}]}]},{"source":"ghsa","ecosystem":"npm","package":"handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8"}]}]},{"source":"ghsa","ecosystem":"npm","package":"handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.5.3"}]}]},{"source":"ghsa","ecosystem":"npm","package":"handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8"}]}]},{"source":"ghsa","ecosystem":"npm","package":"handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.5.3"}]}]},{"source":"ghsa","ecosystem":"npm","package":"handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.0"},{"fixed":"4.1.2"}]}]},{"source":"ghsa","ecosystem":"npm","package":"handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.0.14"}]}]},{"source":"ghsa","ecosystem":"npm","package":"handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7"}]}]},{"source":"ghsa","ecosystem":"npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.4"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.0-tuxcare.0"},{"fixed":"2.3.0-tuxcare.1"}]}],"versions":["2.3.0"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.8-tuxcare.0"},{"fixed":"2.5.8-tuxcare.1"}]}],"versions":["2.5.8"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.3-tuxcare.0"},{"fixed":"2.4.3-tuxcare.1"}]}],"versions":["2.4.3"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.0-tuxcare.0"},{"fixed":"1.3.0-tuxcare.1"}]}],"versions":["1.3.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.12-tuxcare.0"},{"fixed":"1.0.12-tuxcare.2"}]}],"versions":["1.0.12","1.0.12-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.6-tuxcare.0"},{"fixed":"3.1.6-tuxcare.1"}]}],"versions":["3.1.6"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.3-tuxcare.0"},{"fixed":"3.2.3-tuxcare.1"}]}],"versions":["3.2.3"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.3-tuxcare.0"},{"fixed":"3.0.3-tuxcare.1"}]}],"versions":["3.0.3"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.7-tuxcare.0"},{"fixed":"2.4.7-tuxcare.1"}]}],"versions":["2.4.7"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.3-tuxcare.0"},{"fixed":"3.1.3-tuxcare.2"}]}],"versions":["3.1.3","3.1.3-tuxcare.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.2-tuxcare.0"},{"fixed":"3.1.2-tuxcare.2"}]}],"versions":["3.1.2","3.1.2-tuxcare.1"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.4-tuxcare.0"},{"fixed":"3.1.4-tuxcare.2"}]}],"versions":["3.1.4","3.1.4-tuxcare.1"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.2-tuxcare.0"},{"fixed":"3.0.2-tuxcare.2"}]}],"versions":["3.0.2","3.0.2-tuxcare.1"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.9-tuxcare.0"},{"fixed":"3.0.9-tuxcare.2"}]}],"versions":["3.0.9","3.0.9-tuxcare.1"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.8-tuxcare.0"},{"fixed":"3.0.8-tuxcare.2"}]}],"versions":["3.0.8","3.0.8-tuxcare.1"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.1-tuxcare.0"},{"fixed":"3.0.1-tuxcare.2"}]}],"versions":["3.0.1","3.0.1-tuxcare.1"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.0-tuxcare.0"},{"fixed":"3.1.0-tuxcare.2"}]}],"versions":["3.1.0","3.1.0-tuxcare.1"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.11-tuxcare.0"},{"fixed":"3.0.11-tuxcare.2"}]}],"versions":["3.0.11","3.0.11-tuxcare.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.1-tuxcare.0"},{"fixed":"3.1.1-tuxcare.2"}]}],"versions":["3.1.1","3.1.1-tuxcare.1"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.6-tuxcare.0"},{"fixed":"3.0.6-tuxcare.3"}]}],"versions":["3.0.6","3.0.6-tuxcare.1","3.0.6-tuxcare.2"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.3-tuxcare.0"},{"fixed":"2.3.3-tuxcare.3"}]}],"versions":["2.3.3","2.3.3-tuxcare.1","2.3.3-tuxcare.2"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.10-tuxcare.0"},{"fixed":"2.3.10-tuxcare.3"}]}],"versions":["2.3.10","2.3.10-tuxcare.1","2.3.10-tuxcare.2"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.8-tuxcare.0"},{"fixed":"2.0.8-tuxcare.4"}]}],"versions":["2.0.8","2.0.8-tuxcare.1","2.0.8-tuxcare.2","2.0.8-tuxcare.3"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.5-tuxcare.0"},{"fixed":"3.0.5-tuxcare.4"}]}],"versions":["3.0.5","3.0.5-tuxcare.1","3.0.5-tuxcare.2","3.0.5-tuxcare.3"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.4-tuxcare.0"},{"fixed":"3.0.4-tuxcare.4"}]}],"versions":["3.0.4","3.0.4-tuxcare.1","3.0.4-tuxcare.2","3.0.4-tuxcare.3"],"bundled":10},{"source":"osv","ecosystem":"Debian:12","package":"node-dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.1+dfsg+~2.4.0-1","2.4.1+dfsg+~2.4.0-2","2.4.1+dfsg+~2.4.0-2+deb12u1","3.0.9+dfsg+~3.0.5-1","3.1.6+dfsg+~3.0.5-1","3.1.7+dfsg+~3.0.5-1","3.1.7+dfsg+~3.0.5-2","3.2.5+dfsg-1","3.3.2+dfsg-1","3.3.3+dfsg-1","3.3.3+dfsg-2","3.4.1+dfsg-1","3.4.12+dfsg-1","3.4.13+dfsg-1","3.4.13+dfsg-2","3.4.2+dfsg-1","3.4.5+dfsg-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.7+dfsg+~3.0.5-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"node-dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.7+dfsg+~3.0.5-2"}]}]},{"source":"osv","ecosystem":"npm","package":"handlebars","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.0.8"}]}]},{"source":"osv","ecosystem":"npm","package":"handlebars","ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0"},{"fixed":"4.5.2"}]}]},{"source":"osv","ecosystem":"npm","package":"handlebars","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.0.8"}]}]},{"source":"osv","ecosystem":"npm","package":"handlebars","ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0"},{"fixed":"4.5.3"}]}]},{"source":"osv","ecosystem":"npm","package":"handlebars","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.0.8"}]}]},{"source":"osv","ecosystem":"npm","package":"handlebars","ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0"},{"fixed":"4.5.3"}]}]},{"source":"osv","ecosystem":"npm","package":"handlebars","ranges":[{"type":"SEMVER","events":[{"introduced":"4.1.0"},{"fixed":"4.1.2"}]}]},{"source":"osv","ecosystem":"npm","package":"handlebars","ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0"},{"fixed":"4.0.14"}]}]},{"source":"osv","ecosystem":"npm","package":"handlebars","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.0.7"}]}]},{"source":"osv","ecosystem":"npm","package":"dompurify","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.2.4"}]}]},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el8","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el8cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el8","package":"ceph-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el8cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el8","package":"ceph-base-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el8cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el8","package":"ceph-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el8cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el8","package":"ceph-common-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el8cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el8","package":"ceph-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el8cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el8","package":"ceph-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el8cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el8","package":"ceph-exporter-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el8cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el8","package":"ceph-fuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el8cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el8","package":"ceph-fuse-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el8cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el8","package":"ceph-immutable-object-cache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el8cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el8","package":"ceph-immutable-object-cache-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el8cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el8","package":"ceph-mds-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el8cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el8","package":"ceph-mgr-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el8cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el8","package":"ceph-mib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el8cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el8","package":"ceph-mon-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el8cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el8","package":"ceph-osd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el8cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el8","package":"ceph-radosgw-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el8cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el8","package":"ceph-resource-agents","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el8cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el8","package":"ceph-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el8cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el8","package":"ceph-test-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el8cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el8","package":"cephfs-mirror-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el8cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el8","package":"cephfs-top","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el8cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el8","package":"libcephfs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el8cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el8","package":"libcephfs2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el8cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el8","package":"libcephfs2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el8cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el8","package":"libcephsqlite-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el8cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el8","package":"librados-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el8cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el8","package":"librados-devel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el8cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el8","package":"librados2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el8cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el8","package":"librados2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el8cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el8","package":"libradospp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el8cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el8","package":"libradosstriper1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el8cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el8","package":"libradosstriper1-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el8cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el8","package":"librbd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el8cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el8","package":"librbd1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el8cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el8","package":"librbd1-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el8cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el8","package":"librgw-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el8cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el8","package":"librgw2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el8cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el8","package":"librgw2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el8cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el8","package":"python3-ceph-argparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el8cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el8","package":"python3-ceph-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el8cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el8","package":"python3-cephfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el8cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el8","package":"python3-cephfs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el8cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el8","package":"python3-rados","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el8cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el8","package":"python3-rados-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el8cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el8","package":"python3-rbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el8cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el8","package":"python3-rbd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el8cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el8","package":"python3-rgw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el8cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el8","package":"python3-rgw-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el8cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el8","package":"rbd-fuse-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el8cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el8","package":"rbd-mirror-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el8cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el8","package":"rbd-nbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el8cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el8","package":"rbd-nbd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el8cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el9","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el9cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el9","package":"ceph-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el9cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el9","package":"ceph-base-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el9cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el9","package":"ceph-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el9cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el9","package":"ceph-common-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el9cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el9","package":"ceph-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el9cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el9","package":"ceph-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el9cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el9","package":"ceph-exporter-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el9cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el9","package":"ceph-fuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el9cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el9","package":"ceph-fuse-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el9cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el9","package":"ceph-immutable-object-cache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el9cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el9","package":"ceph-immutable-object-cache-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el9cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el9","package":"ceph-mds-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el9cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el9","package":"ceph-mgr-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el9cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el9","package":"ceph-mib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el9cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el9","package":"ceph-mon-client-nvmeof-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el9cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el9","package":"ceph-mon-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el9cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el9","package":"ceph-osd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el9cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el9","package":"ceph-radosgw-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el9cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el9","package":"ceph-resource-agents","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el9cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el9","package":"ceph-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el9cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el9","package":"ceph-test-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el9cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el9","package":"cephadm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el9cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el9","package":"cephfs-mirror-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el9cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el9","package":"cephfs-top","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el9cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el9","package":"libcephfs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el9cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el9","package":"libcephfs2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el9cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el9","package":"libcephfs2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el9cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el9","package":"libcephsqlite-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el9cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el9","package":"librados-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el9cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el9","package":"librados-devel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el9cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el9","package":"librados2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el9cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el9","package":"librados2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el9cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el9","package":"libradospp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el9cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el9","package":"libradosstriper1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el9cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el9","package":"libradosstriper1-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el9cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el9","package":"librbd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el9cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el9","package":"librbd1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el9cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el9","package":"librbd1-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el9cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el9","package":"librgw-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el9cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el9","package":"librgw2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el9cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el9","package":"librgw2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el9cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el9","package":"python3-ceph-argparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el9cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el9","package":"python3-ceph-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el9cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el9","package":"python3-cephfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el9cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el9","package":"python3-cephfs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el9cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el9","package":"python3-rados","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el9cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el9","package":"python3-rados-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el9cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el9","package":"python3-rbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el9cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el9","package":"python3-rbd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el9cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el9","package":"python3-rgw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el9cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el9","package":"python3-rgw-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el9cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el9","package":"rbd-fuse-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el9cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el9","package":"rbd-mirror-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el9cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el9","package":"rbd-nbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el9cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ceph_storage:7.1::el9","package":"rbd-nbd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:18.2.1-381.el9cp"}]}],"bundled":11},{"source":"osv","ecosystem":"Root:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.8-aikido.3"},{"fixed":"2.5.9-aikido.1"},{"fixed":"2.5.8-aikido.1"},{"fixed":"2.5.9-aikido.2"},{"fixed":"2.5.9-aikido.3"},{"fixed":"2.5.8-aikido.2"},{"fixed":"2.5.9-aikido.4"},{"fixed":"2.5.9-aikido.5"},{"fixed":"3.2.4-aikido.1"},{"fixed":"3.2.4-aikido.2"},{"fixed":"3.2.4-aikido.3"},{"fixed":"3.2.4-aikido.4"},{"fixed":"3.2.4-aikido.5"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.8-root.io.3"},{"fixed":"2.5.9-root.io.1"},{"fixed":"2.5.8-root.io.1"},{"fixed":"2.5.9-root.io.2"},{"fixed":"2.5.9-root.io.3"},{"fixed":"2.5.8-root.io.2"},{"fixed":"2.5.9-root.io.4"},{"fixed":"2.5.9-root.io.5"},{"fixed":"3.2.4-root.io.1"},{"fixed":"3.2.4-root.io.2"},{"fixed":"3.2.4-root.io.3"},{"fixed":"3.2.4-root.io.4"},{"fixed":"3.2.4-root.io.5"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7-aikido.3"},{"fixed":"3.0.3-aikido.2"},{"fixed":"3.0.8-aikido.1"},{"fixed":"3.0.8-aikido.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7-root.io.3"},{"fixed":"3.0.3-root.io.2"},{"fixed":"3.0.8-root.io.1"},{"fixed":"3.0.8-root.io.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7-aikido.3"},{"fixed":"3.0.3-aikido.2"},{"fixed":"3.0.8-aikido.1"},{"fixed":"3.0.8-aikido.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7-root.io.3"},{"fixed":"3.0.3-root.io.2"},{"fixed":"3.0.8-root.io.1"},{"fixed":"3.0.8-root.io.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7-aikido.3"},{"fixed":"3.0.3-aikido.2"},{"fixed":"3.0.8-aikido.1"},{"fixed":"3.0.8-aikido.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7-root.io.3"},{"fixed":"3.0.3-root.io.2"},{"fixed":"3.0.8-root.io.1"},{"fixed":"3.0.8-root.io.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3-aikido.2"},{"fixed":"3.0.7-aikido.1"},{"fixed":"3.0.7-aikido.2"},{"fixed":"3.0.7-aikido.3"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/handlebars","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3-root.io.2"},{"fixed":"3.0.7-root.io.1"},{"fixed":"3.0.7-root.io.2"},{"fixed":"3.0.7-root.io.3"}]}]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.0+dfsg-2","2.3.3+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.1+dfsg+~2.4.0-1","3.0.9+dfsg+~3.0.5-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"node-dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.7+dfsg+~3.0.5-1","3.1.7+dfsg+~3.0.5-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.3.3+dfsg-1","3.4.2+dfsg-1","3.4.5+dfsg-1","3.4.12+dfsg-1","3.4.13+dfsg-1","3.4.13+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.7+dfsg+~3.0.5-2","3.3.3+dfsg-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"argocd-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.14.8-1.1"}]}]}],"products":[{"vendor":"cure53","product":"dompurify"}],"references":[{"url":"https://github.com/cure53/DOMPurify/releases/tag/3.2.4","tags":["Release Notes","web","article","report"]},{"url":"https://github.com/cure53/DOMPurify/commit/d18ffcb554e0001748865da03ac75dd7829f0f02","tags":["Patch","fix","web","article","report"]},{"url":"https://nsysean.github.io/posts/dompurify-323-bypass/","tags":["Exploit","Third Party Advisory","web","article","report"]},{"url":"https://ensy.zip/posts/dompurify-323-bypass/","tags":["exploit","Exploit","Third Party Advisory","web","article","report"]},{"url":"https://www.npmjs.com/advisories/1316","tags":["web"]},{"url":"https://github.com/advisories/GHSA-2cf5-4w76-r9qv"},{"url":"https://www.npmjs.com/advisories/1325","tags":["web"]},{"url":"https://github.com/advisories/GHSA-g9r4-xpmj-mj65"},{"url":"https://www.npmjs.com/advisories/1324","tags":["web"]},{"url":"https://github.com/advisories/GHSA-q2c6-c6pm-g3gh"},{"url":"https://github.com/handlebars-lang/handlebars.js/issues/1495","tags":["web"]},{"url":"https://github.com/handlebars-lang/handlebars.js/commit/7372d4e9dffc9d70c09671aa28b9392a1577fd86","tags":["web"]},{"url":"https://snyk.io/vuln/SNYK-JS-HANDLEBARS-173692","tags":["web"]},{"url":"https://www.npmjs.com/advisories/755","tags":["web"]},{"url":"https://github.com/handlebars-lang/handlebars.js/commit/0d6d8c335ad81bad1b672fc56b6a44f6aa472dac","tags":["web"]},{"url":"https://github.com/handlebars-lang/handlebars.js/commit/85c8783b34fc6d36145d8b53885ad0b9e3c3f9c4","tags":["web"]},{"url":"https://github.com/handlebars-lang/handlebars.js/commit/cd38583216dce3252831916323202749431c773e","tags":["web"]},{"url":"https://github.com/advisories/GHSA-q42p-pg8m-cqh6"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-26791","tags":["advisory"]},{"url":"https://ensy.zip/posts/dompurify-323-bypass","tags":["web"]},{"url":"https://nsysean.github.io/posts/dompurify-323-bypass","tags":["web"]},{"url":"https://github.com/advisories/GHSA-vhxf-7vqr-mrjg"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/26xxx/CVE-2025-26791.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-26791","tags":["advisory"]},{"url":"https://github.com/cure53/DOMPurify","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2026:2769","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1944286","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2112230","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2272997","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2273911","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2312579","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2323735","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2329426","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2345695","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2360974","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2372611","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2374412","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2389907","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2392386","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2392861","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2404076","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2404656","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2404880","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2412237","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2412474","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2414844","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2414943","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2416314","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2418462","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2428617","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2432069","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_2769.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-23358","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-23358","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-23358","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-34749","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-34749","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-34749","tags":["advisory"]},{"url":"https://github.com/lepture/mistune/commit/a6d43215132fe4f3d93f8d7e90ba83b16a0838b2","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-11831","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-11831","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-11831","tags":["advisory"]},{"url":"https://github.com/yahoo/serialize-javascript/commit/f27d65d3de42affe2aac14607066c293891cec4e","tags":["article"]},{"url":"https://github.com/yahoo/serialize-javascript/pull/173","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-31884","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-31884","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-31884","tags":["advisory"]},{"url":"https://github.com/ceph/ceph/pull/66089","tags":["article"]},{"url":"https://github.com/ceph/ceph/pull/66140","tags":["article"]},{"url":"https://github.com/ceph/ceph/pull/66141","tags":["article"]},{"url":"https://github.com/ceph/ceph/pull/66142","tags":["article"]},{"url":"https://github.com/ceph/ceph/security/advisories/GHSA-xj9f-7g59-m4jx","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-47866","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-47866","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47866","tags":["advisory"]},{"url":"https://github.com/ceph/ceph/security/advisories/GHSA-mgrm-g92q-f8h8","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-51744","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-51744","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-51744","tags":["advisory"]},{"url":"https://github.com/golang-jwt/jwt/commit/7b1c1c00a171c6c79bbdb40e4ce7d197060c1c2c","tags":["article"]},{"url":"https://github.com/golang-jwt/jwt/security/advisories/GHSA-29wx-vh33-7x7r","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-55565","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2331063","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-55565","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-55565","tags":["advisory"]},{"url":"https://github.com/ai/nanoid/compare/3.3.7...3.3.8","tags":["article"]},{"url":"https://github.com/ai/nanoid/pull/510","tags":["article"]},{"url":"https://github.com/ai/nanoid/releases/tag/5.0.9","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-26791","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-26791","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-47913","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-47913","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-47913","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-hcg3-q754-cr77","tags":["advisory"]},{"url":"https://go.dev/cl/700295","tags":["article"]},{"url":"https://go.dev/issue/75178","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2025-4116","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-52555","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-52555","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-52555","tags":["advisory"]},{"url":"https://github.com/ceph/ceph/pull/60314","tags":["article"]},{"url":"https://github.com/ceph/ceph/security/advisories/GHSA-89hm-qq33-2fjm","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-61729","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-61729","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61729","tags":["advisory"]},{"url":"https://go.dev/cl/725920","tags":["article"]},{"url":"https://go.dev/issue/76445","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/8FJoBkPddm4","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2025-4155","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-26791","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/TTJ7LJNX5AFLSOMXVINY4EKWQGZA76AH/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-26791","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-26791","description":"DOMPurify before 3.2.4 has an incorrect template literal regular expression, sometimes leading to mutation cross-site scripting (mXSS).","status":"published","published":"2025-02-14T00:00:00Z","modified":"2025-02-14T15:30:49.79Z","cvss":[{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:32:27.932735Z"}],"euvd":[{"id":"EUVD-2025-4245","description":"DOMPurify before 3.2.4 has an incorrect template literal regular expression, sometimes leading to mutation cross-site scripting (mXSS).","status":"published","published":"2025-02-14T00:00:00Z","modified":"2025-02-14T15:30:49Z","cvss":[{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:53:30.772675Z"}],"ghsa":[{"id":"GHSA-2cf5-4w76-r9qv","title":"Arbitrary Code Execution in handlebars","description":"Versions of `handlebars` prior to 3.0.8 or 4.5.2 are vulnerable to Arbitrary Code Execution. The package's lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript in the system. It can be used to run arbitrary code in a server processing Handlebars templates or on a victim's browser (effectively serving as Cross-Site Scripting).\n\nThe following template can be used to demonstrate the vulnerability:  \n```{{#with \"constructor\"}}\n\t{{#with split as |a|}}\n\t\t{{pop (push \"alert('Vulnerable Handlebars JS');\")}}\n\t\t{{#with (concat (lookup join (slice 0 1)))}}\n\t\t\t{{#each (slice 2 3)}}\n\t\t\t\t{{#with (apply 0 a)}}\n\t\t\t\t\t{{.}}\n\t\t\t\t{{/with}}\n\t\t\t{{/each}}\n\t\t{{/with}}\n\t{{/with}}\n{{/with}}```\n\n\n## Recommendation\n\nUpgrade to version 3.0.8, 4.5.2 or later.","status":"published","published":"2020-09-04T14:57:38Z","modified":"2024-02-07T05:08:28Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:L","level":"high"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:37:36.076201Z"},{"id":"GHSA-q42p-pg8m-cqh6","title":"Prototype Pollution in handlebars","description":"Versions of `handlebars` prior to 4.0.14 are vulnerable to Prototype Pollution. Templates may alter an Objects' prototype, thus allowing an attacker to execute arbitrary code on the server.\n\n\n## Recommendation\n\nFor handlebars 4.1.x upgrade to 4.1.2 or later.\nFor handlebars 4.0.x upgrade to 4.0.14 or later.","status":"published","published":"2019-06-05T14:07:48Z","modified":"2023-11-29T20:32:55Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-471"],"updated_at":"2026-11-02T14:37:22.840002Z"},{"id":"GHSA-vhxf-7vqr-mrjg","title":"DOMPurify allows Cross-site Scripting (XSS)","description":"DOMPurify before 3.2.4 has an incorrect template literal regular expression when SAFE_FOR_TEMPLATES is set to true, sometimes leading to mutation cross-site scripting (mXSS).","status":"published","published":"2025-02-14T09:31:22Z","modified":"2025-06-30T14:24:15Z","cvss":[{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:38:48.783737Z"},{"id":"GHSA-g9r4-xpmj-mj65","title":"Prototype Pollution in handlebars","description":"Versions of `handlebars` prior to 3.0.8 or 4.5.3 are vulnerable to prototype pollution. It is possible to add or modify properties to the Object prototype through a malicious template. This may allow attackers to crash the application or execute Arbitrary Code in specific conditions.\n\n\n## Recommendation\n\nUpgrade to version 3.0.8, 4.5.3 or later.","status":"published","published":"2020-09-04T15:06:32Z","modified":"2023-01-09T05:04:02Z","cwes":["CWE-1321"],"updated_at":"2026-11-02T14:36:08.267721Z"},{"id":"GHSA-q2c6-c6pm-g3gh","title":"Arbitrary Code Execution in handlebars","description":"Versions of `handlebars` prior to 3.0.8 or 4.5.3 are vulnerable to Arbitrary Code Execution. The package's lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript in the system. It is due to an incomplete fix for a [previous issue](https://www.npmjs.com/advisories/1316). This vulnerability can be used to run arbitrary code in a server processing Handlebars templates or on a victim's browser (effectively serving as Cross-Site Scripting).\n\n\n## Recommendation\n\nUpgrade to version 3.0.8, 4.5.3 or later.","status":"published","published":"2020-09-04T15:07:38Z","modified":"2023-01-09T05:04:24Z","updated_at":"2026-11-02T14:36:09.554044Z"}],"nvd":[{"id":"CVE-2025-26791","description":"DOMPurify before 3.2.4 has an incorrect template literal regular expression, sometimes leading to mutation cross-site scripting (mXSS).","status":"published","published":"2025-02-14T09:15:08.067Z","modified":"2026-06-17T09:02:26.64Z","cvss":[{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:10:51.445921Z"}],"osv":[{"id":"CVE-2025-26791","description":"DOMPurify before 3.2.4 has an incorrect template literal regular expression, sometimes leading to mutation cross-site scripting (mXSS).","status":"published","published":"2025-02-14T00:00:00Z","modified":"2026-10-28T02:30:43.597892433Z","cvss":[{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:44:47.386092Z"},{"id":"DEBIAN-CVE-2025-26791","description":"DOMPurify before 3.2.4 has an incorrect template literal regular expression, sometimes leading to mutation cross-site scripting (mXSS).","status":"published","published":"2025-02-14T09:15:08.067Z","modified":"2026-09-01T20:05:44.958054799Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:45.870237Z"},{"id":"GHSA-2cf5-4w76-r9qv","title":"Arbitrary Code Execution in handlebars","description":"Versions of `handlebars` prior to 3.0.8 or 4.5.2 are vulnerable to Arbitrary Code Execution. The package's lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript in the system. It can be used to run arbitrary code in a server processing Handlebars templates or on a victim's browser (effectively serving as Cross-Site Scripting).\n\nThe following template can be used to demonstrate the vulnerability:  \n```{{#with \"constructor\"}}\n\t{{#with split as |a|}}\n\t\t{{pop (push \"alert('Vulnerable Handlebars JS');\")}}\n\t\t{{#with (concat (lookup join (slice 0 1)))}}\n\t\t\t{{#each (slice 2 3)}}\n\t\t\t\t{{#with (apply 0 a)}}\n\t\t\t\t\t{{.}}\n\t\t\t\t{{/with}}\n\t\t\t{{/each}}\n\t\t{{/with}}\n\t{{/with}}\n{{/with}}```\n\n\n## Recommendation\n\nUpgrade to version 3.0.8, 4.5.2 or later.","status":"published","published":"2020-09-04T14:57:38Z","modified":"2026-09-10T03:48:33.174881747Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:L","level":"high"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:46:34.338541Z"},{"id":"GHSA-q42p-pg8m-cqh6","title":"Prototype Pollution in handlebars","description":"Versions of `handlebars` prior to 4.0.14 are vulnerable to Prototype Pollution. Templates may alter an Objects' prototype, thus allowing an attacker to execute arbitrary code on the server.\n\n\n## Recommendation\n\nFor handlebars 4.1.x upgrade to 4.1.2 or later.\nFor handlebars 4.0.x upgrade to 4.0.14 or later.","status":"published","published":"2019-06-05T14:07:48Z","modified":"2026-09-10T03:48:23.648231681Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-471"],"updated_at":"2026-11-02T15:46:54.055966Z"},{"id":"GHSA-vhxf-7vqr-mrjg","title":"DOMPurify allows Cross-site Scripting (XSS)","description":"DOMPurify before 3.2.4 has an incorrect template literal regular expression when SAFE_FOR_TEMPLATES is set to true, sometimes leading to mutation cross-site scripting (mXSS).","status":"published","published":"2025-02-14T09:31:22Z","modified":"2026-09-10T03:50:06.152680854Z","cvss":[{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:57.348035Z"},{"id":"RHSA-2026:2769","title":"Red Hat Security Advisory: Red Hat Ceph Storage 7.1 security and bug fix updates","status":"published","published":"2026-04-04T10:05:14Z","modified":"2026-10-20T10:06:52Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.449341Z"},{"id":"UBUNTU-CVE-2025-26791","description":"DOMPurify before 3.2.4 has an incorrect template literal regular expression, sometimes leading to mutation cross-site scripting (mXSS).","status":"published","published":"2025-02-14T09:15:00Z","modified":"2026-10-17T12:56:49.308903184Z","cvss":[{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:55:26.330196Z"},{"id":"CLSA-2026-1774398077","title":"TuxCare security update for dompurify (4 CVEs)","description":"TuxCare rebuilt dompurify to address 4 CVEs. Fixed in 2.3.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:15Z","modified":"2026-10-15T09:47:04.371306811Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1774398078","title":"TuxCare security update for dompurify (1 CVE)","description":"TuxCare rebuilt dompurify to address 1 CVE. Fixed in 2.5.8-tuxcare.1.","status":"published","published":"2026-08-04T14:52:15Z","modified":"2026-10-15T09:47:05.846265347Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1774398080","title":"TuxCare security update for dompurify (3 CVEs)","description":"TuxCare rebuilt dompurify to address 3 CVEs. Fixed in 2.4.3-tuxcare.1.","status":"published","published":"2026-08-04T14:52:15Z","modified":"2026-10-15T09:47:04.367991282Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1774743817","title":"TuxCare security update for handlebars (1 CVE)","description":"TuxCare rebuilt handlebars to address 1 CVE. Fixed in 1.3.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:15Z","modified":"2026-10-15T09:47:48.668758728Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1774743830","title":"TuxCare security update for handlebars (3 CVEs)","description":"TuxCare rebuilt handlebars to address 3 CVEs. Fixed in 1.0.12-tuxcare.2.","status":"published","published":"2026-08-04T14:52:16Z","modified":"2026-10-23T19:28:13.663406058Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1778201083","title":"TuxCare security update for dompurify (1 CVE)","description":"TuxCare rebuilt dompurify to address 1 CVE. Fixed in 3.1.6-tuxcare.1.","status":"published","published":"2026-08-04T14:52:30Z","modified":"2026-10-15T09:45:29.56824129Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1778805976","title":"TuxCare security update for dompurify (10 CVEs)","description":"TuxCare rebuilt dompurify to address 10 CVEs. Fixed in 3.2.3-tuxcare.1.","status":"published","published":"2026-08-04T14:52:31Z","modified":"2026-10-15T09:45:31.523670706Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1780274966","title":"TuxCare security update for dompurify (10 CVEs)","description":"TuxCare rebuilt dompurify to address 10 CVEs. Fixed in 3.0.3-tuxcare.1.","status":"published","published":"2026-08-04T14:52:34Z","modified":"2026-10-15T09:48:03.584932787Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1780361389","title":"TuxCare security update for dompurify (9 CVEs)","description":"TuxCare rebuilt dompurify to address 9 CVEs. Fixed in 2.4.7-tuxcare.1.","status":"published","published":"2026-08-04T14:52:34Z","modified":"2026-10-15T09:48:03.558095016Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"CLSA-2026-1786539981","title":"TuxCare security update for dompurify (10 CVEs)","description":"TuxCare rebuilt dompurify to address 10 CVEs. Fixed in 2.3.0-tuxcare.1.","status":"withdrawn","published":"2026-08-12T13:06:21Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"CLSA-2026-1786636600","title":"TuxCare security update for dompurify (16 CVEs)","description":"TuxCare rebuilt dompurify to address 16 CVEs. Fixed in 2.4.0-tuxcare.1.","status":"withdrawn","published":"2026-08-13T15:56:40Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1786636613","title":"TuxCare security update for dompurify (11 CVEs)","description":"TuxCare rebuilt dompurify to address 11 CVEs. Fixed in 2.4.3-tuxcare.1.","status":"withdrawn","published":"2026-08-13T15:56:53Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1786636721","title":"TuxCare security update for dompurify (14 CVEs)","description":"TuxCare rebuilt dompurify to address 14 CVEs. Fixed in 2.4.7-tuxcare.1.","status":"withdrawn","published":"2026-08-13T15:58:41Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1786731948","title":"TuxCare security update for dompurify (34 CVEs)","description":"TuxCare rebuilt dompurify to address 34 CVEs. Fixed in 3.0.3-tuxcare.1.","status":"withdrawn","published":"2026-08-14T18:25:48Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1792155851","title":"TuxCare security update for dompurify (12 CVEs)","description":"TuxCare rebuilt dompurify to address 12 CVEs. Fixed in 3.1.3-tuxcare.2.","status":"published","published":"2026-10-16T13:04:11Z","modified":"2026-10-21T20:43:23.163914038Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"CLSA-2026-1792156267","title":"TuxCare security update for dompurify (9 CVEs)","description":"TuxCare rebuilt dompurify to address 9 CVEs. Fixed in 3.1.2-tuxcare.2.","status":"published","published":"2026-10-16T13:11:07Z","modified":"2026-10-21T20:43:22.742858668Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"CLSA-2026-1792156282","title":"TuxCare security update for dompurify (11 CVEs)","description":"TuxCare rebuilt dompurify to address 11 CVEs. Fixed in 3.1.4-tuxcare.2.","status":"published","published":"2026-10-16T13:11:22Z","modified":"2026-10-21T20:43:22.552871845Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"CLSA-2026-1792156382","title":"TuxCare security update for dompurify (9 CVEs)","description":"TuxCare rebuilt dompurify to address 9 CVEs. Fixed in 3.0.2-tuxcare.2.","status":"published","published":"2026-10-16T13:13:02Z","modified":"2026-10-21T20:43:22.190952605Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"CLSA-2026-1792156589","title":"TuxCare security update for dompurify (10 CVEs)","description":"TuxCare rebuilt dompurify to address 10 CVEs. Fixed in 3.0.9-tuxcare.2.","status":"published","published":"2026-10-16T13:16:29Z","modified":"2026-10-21T20:43:20.928803832Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"CLSA-2026-1792156694","title":"TuxCare security update for dompurify (11 CVEs)","description":"TuxCare rebuilt dompurify to address 11 CVEs. Fixed in 3.0.8-tuxcare.2.","status":"published","published":"2026-10-16T13:18:14Z","modified":"2026-10-21T20:43:18.588659369Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"CLSA-2026-1792156909","title":"TuxCare security update for dompurify (10 CVEs)","description":"TuxCare rebuilt dompurify to address 10 CVEs. Fixed in 3.0.1-tuxcare.2.","status":"published","published":"2026-10-16T13:21:49Z","modified":"2026-10-21T20:43:22.31228165Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"CLSA-2026-1792157013","title":"TuxCare security update for dompurify (13 CVEs)","description":"TuxCare rebuilt dompurify to address 13 CVEs. Fixed in 3.1.0-tuxcare.2.","status":"published","published":"2026-10-16T13:23:33Z","modified":"2026-10-21T20:43:22.452640022Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"CLSA-2026-1792157113","title":"TuxCare security update for dompurify (12 CVEs)","description":"TuxCare rebuilt dompurify to address 12 CVEs. Fixed in 3.0.11-tuxcare.2.","status":"published","published":"2026-10-16T13:25:13Z","modified":"2026-10-21T20:43:21.625485698Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"CLSA-2026-1792161408","title":"TuxCare security update for dompurify (8 CVEs)","description":"TuxCare rebuilt dompurify to address 8 CVEs. Fixed in 3.1.1-tuxcare.2.","status":"published","published":"2026-10-16T14:36:47Z","modified":"2026-10-21T20:43:19.85040711Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792369452","title":"TuxCare security update for dompurify (6 CVEs)","description":"TuxCare rebuilt dompurify to address 6 CVEs. Fixed in 3.0.6-tuxcare.3.","status":"published","published":"2026-10-19T00:24:12Z","modified":"2026-10-19T07:45:38.150098133Z","updated_at":"2026-11-02T15:43:53.353888Z"},{"id":"CLSA-2026-1792424449","title":"TuxCare security update for dompurify (12 CVEs)","description":"TuxCare rebuilt dompurify to address 12 CVEs. Fixed in 2.3.3-tuxcare.3.","status":"published","published":"2026-10-19T15:40:49Z","modified":"2026-11-05T13:28:25.722214359Z","updated_at":"2026-11-05T16:37:45.64821Z"},{"id":"CLSA-2026-1792424891","title":"TuxCare security update for dompurify (13 CVEs)","description":"TuxCare rebuilt dompurify to address 13 CVEs. Fixed in 2.3.10-tuxcare.3.","status":"published","published":"2026-10-19T15:48:11Z","modified":"2026-10-19T19:15:02.914996103Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792601061","title":"TuxCare security update for dompurify (2 CVEs)","description":"TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 2.0.8-tuxcare.4.","status":"published","published":"2026-10-21T16:44:21Z","modified":"2026-10-21T20:30:50.501154271Z","updated_at":"2026-11-02T15:43:54.672859Z"},{"id":"CLSA-2026-1793101871","title":"TuxCare security update for dompurify (11 CVEs)","description":"TuxCare rebuilt dompurify to address 11 CVEs. Fixed in 3.0.5-tuxcare.4.","status":"published","published":"2026-10-27T11:51:11Z","modified":"2026-10-27T13:30:17.537780888Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793102041","title":"TuxCare security update for dompurify (11 CVEs)","description":"TuxCare rebuilt dompurify to address 11 CVEs. Fixed in 3.0.4-tuxcare.4.","status":"published","published":"2026-10-27T11:54:01Z","modified":"2026-10-27T13:30:18.443508774Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"GHSA-g9r4-xpmj-mj65","title":"Prototype Pollution in handlebars","description":"Versions of `handlebars` prior to 3.0.8 or 4.5.3 are vulnerable to prototype pollution. It is possible to add or modify properties to the Object prototype through a malicious template. This may allow attackers to crash the application or execute Arbitrary Code in specific conditions.\n\n\n## Recommendation\n\nUpgrade to version 3.0.8, 4.5.3 or later.","status":"published","published":"2020-09-04T15:06:32Z","modified":"2026-09-10T03:49:13.649783342Z","cwes":["CWE-1321"],"updated_at":"2026-11-02T15:46:47.472172Z"},{"id":"GHSA-q2c6-c6pm-g3gh","title":"Arbitrary Code Execution in handlebars","description":"Versions of `handlebars` prior to 3.0.8 or 4.5.3 are vulnerable to Arbitrary Code Execution. The package's lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript in the system. It is due to an incomplete fix for a [previous issue](https://www.npmjs.com/advisories/1316). This vulnerability can be used to run arbitrary code in a server processing Handlebars templates or on a victim's browser (effectively serving as Cross-Site Scripting).\n\n\n## Recommendation\n\nUpgrade to version 3.0.8, 4.5.3 or later.","status":"published","published":"2020-09-04T15:07:38Z","modified":"2026-09-10T03:48:58.277710865Z","updated_at":"2026-11-02T15:46:53.700556Z"},{"id":"openSUSE-SU-2025:14921-1","title":"argocd-cli-2.14.8-1.1 on GA media","description":"These are all security issues fixed in the argocd-cli-2.14.8-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-03-25T00:00:00Z","modified":"2026-02-04T03:14:53.256488Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"ROOT-APP-NPM-CVE-2025-26791","title":"CVE-2025-26791 in dompurify - Patched by Root","description":"Root has patched CVE-2025-26791 in the dompurify package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-10-28T04:55:46Z","modified":"2026-10-28T05:15:04.09539316Z","updated_at":"2026-11-02T15:53:27.362922Z"},{"id":"ROOT-APP-NPM-GHSA-2cf5-4w76-r9qv","title":"GHSA-2cf5-4w76-r9qv in handlebars - Patched by Root","description":"Root has patched GHSA-2cf5-4w76-r9qv in the handlebars package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-10-20T10:47:36Z","modified":"2026-10-20T11:15:38.540557189Z","updated_at":"2026-11-02T15:53:27.940619Z"},{"id":"ROOT-APP-NPM-GHSA-g9r4-xpmj-mj65","title":"GHSA-g9r4-xpmj-mj65 in handlebars - Patched by Root","description":"Root has patched GHSA-g9r4-xpmj-mj65 in the handlebars package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-10-20T10:47:36Z","modified":"2026-10-20T11:15:39.391242933Z","updated_at":"2026-11-02T15:53:27.940619Z"},{"id":"ROOT-APP-NPM-GHSA-q2c6-c6pm-g3gh","title":"GHSA-q2c6-c6pm-g3gh in handlebars - Patched by Root","description":"Root has patched GHSA-q2c6-c6pm-g3gh in the handlebars package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-10-20T10:47:36Z","modified":"2026-10-20T11:15:37.928892011Z","updated_at":"2026-11-02T15:53:27.940619Z"},{"id":"ROOT-APP-NPM-GHSA-q42p-pg8m-cqh6","title":"GHSA-q42p-pg8m-cqh6 in handlebars - Patched by Root","description":"Root has patched GHSA-q42p-pg8m-cqh6 in the handlebars package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-10-20T10:47:36Z","modified":"2026-10-20T11:15:37.540463486Z","updated_at":"2026-11-02T15:53:27.940619Z"}]}}