Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade podmanUpgrade opentelemetry-collectorUpgrade podman-pluginsUpgrade podman-testsUpgrade podman-dockerUpgrade podman-remote | Jul 7, 2026 | Jul 1, 2026 |
| Amazon Linux Ami 2 | — | Upgrade docker-debuginfoUpgrade runfinch-finchUpgrade ecs-initUpgrade nerdctlUpgrade containerd-stressUpgrade dockerUpgrade containerdUpgrade nerdctl-debuginfoUpgrade soci-snapshotterUpgrade containerd-debuginfo | Jun 16, 2026 | Jun 16, 2026 |
| Amazon_linux_2023 | — | Upgrade containerd-stress-debuginfoUpgrade dockerUpgrade containerd-debugsourceUpgrade containerdUpgrade containerd-debuginfoUpgrade containerd-stressUpgrade soci-snapshotterUpgrade nerdctlUpgrade credentials-fetcherUpgrade docker-debugsourceUpgrade docker-debuginfoUpgrade runfinch-finchUpgrade ecs-init | Jun 15, 2026 | May 22, 2026 |
| Redhat_linux | — | Upgrade flightctl-observabilityUpgrade osbuild-composer-workerUpgrade grafanaUpgrade osbuild-composerUpgrade opentelemetry-collectorUpgrade flightctl-servicesUpgrade osbuild-composer-debugsourceUpgrade osbuild-composer-worker-debuginfoUpgrade podman-tests-debuginfoUpgrade flightctl-agentUpgrade podman-debugsourceUpgrade image-builderUpgrade grafana-debugsourceUpgrade podman-plugins-debuginfoUpgrade podman-debuginfoUpgrade podman-remoteUpgrade osbuild-composer-tests-debuginfoUpgrade flightctl-selinuxUpgrade podmanUpgrade grafana-debuginfoUpgrade podman-pluginsUpgrade podman-dockerUpgrade osbuild-composer-dnf-jsonUpgrade image-builder-debugsourceUpgrade flightctl-cliUpgrade grafana-selinuxNo solution existsUpgrade osbuild-composer-debuginfoUpgrade podman-testsUpgrade osbuild-composer-core-debuginfoUpgrade podman-remote-debuginfoUpgrade osbuild-composer-coreUpgrade image-builder-debuginfo | Jul 3, 2026 | May 22, 2026 |
| Rocky_linux | — | Upgrade grafana-selinuxUpgrade osbuild-composer-coreUpgrade podman-debuginfoUpgrade image-builder-debuginfoUpgrade image-builder-debugsourceUpgrade podmanUpgrade podman-pluginsUpgrade osbuild-composer-core-debuginfoUpgrade image-builderUpgrade podman-debugsourceUpgrade podman-remoteUpgrade podman-remote-debuginfoUpgrade osbuild-composerUpgrade opentelemetry-collectorUpgrade osbuild-composer-workerUpgrade podman-testsUpgrade grafana-debugsourceUpgrade osbuild-composer-worker-debuginfoUpgrade osbuild-composer-debugsourceUpgrade podman-tests-debuginfoUpgrade osbuild-composer-debuginfoUpgrade podman-plugins-debuginfoUpgrade grafanaUpgrade grafana-debuginfo | Jul 7, 2026 | Jul 5, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub