Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade podman-dockerUpgrade podmanUpgrade podman-remoteUpgrade podman-testsUpgrade podman-plugins | Jul 13, 2026 | Jul 9, 2026 |
| Amazon Linux Ami 2 | — | Upgrade docker-debuginfoUpgrade ecs-initUpgrade containerd-stressUpgrade runfinch-finchUpgrade containerdUpgrade dockerUpgrade nerdctl-debuginfoUpgrade nerdctlUpgrade soci-snapshotterUpgrade containerd-debuginfo | Jun 16, 2026 | Jun 16, 2026 |
| Amazon_linux_2023 | — | Upgrade containerd-stressUpgrade runfinch-finchUpgrade soci-snapshotterUpgrade dockerUpgrade nerdctlUpgrade containerd-debugsourceUpgrade docker-debugsourceUpgrade credentials-fetcherUpgrade containerdUpgrade ecs-initUpgrade docker-debuginfoUpgrade containerd-stress-debuginfoUpgrade containerd-debuginfo | Jun 15, 2026 | May 22, 2026 |
| Redhat_linux | — | Upgrade osbuild-composerUpgrade podman-tests-debuginfoUpgrade image-builderUpgrade image-builder-debuginfoUpgrade podmanUpgrade podman-debuginfoUpgrade osbuild-composer-worker-debuginfoUpgrade grafana-debuginfoUpgrade podman-testsUpgrade flightctl-servicesNo solution existsUpgrade podman-remoteUpgrade podman-dockerUpgrade flightctl-selinuxUpgrade osbuild-composer-debugsourceUpgrade grafana-selinuxUpgrade flightctl-cliUpgrade osbuild-composer-workerUpgrade flightctl-agentUpgrade opentelemetry-collectorUpgrade flightctl-observabilityUpgrade osbuild-composer-dnf-jsonUpgrade podman-plugins-debuginfoUpgrade podman-remote-debuginfoUpgrade osbuild-composer-tests-debuginfoUpgrade grafanaUpgrade osbuild-composer-coreUpgrade podman-debugsourceUpgrade osbuild-composer-core-debuginfoUpgrade osbuild-composer-debuginfoUpgrade grafana-debugsourceUpgrade image-builder-debugsourceUpgrade podman-plugins | Jul 10, 2026 | May 22, 2026 |
| Rocky_linux | — | Upgrade podmanUpgrade image-builderUpgrade podman-remote-debuginfoUpgrade osbuild-composer-coreUpgrade osbuild-composer-worker-debuginfoUpgrade image-builder-debuginfoUpgrade podman-plugins-debuginfoUpgrade osbuild-composerUpgrade podman-debuginfoUpgrade podman-remoteUpgrade osbuild-composer-core-debuginfoUpgrade podman-tests-debuginfoUpgrade osbuild-composer-debugsourceUpgrade osbuild-composer-debuginfoUpgrade podman-pluginsUpgrade podman-testsUpgrade image-builder-debugsourceUpgrade osbuild-composer-workerUpgrade podman-debugsource | Jul 13, 2026 | Jul 10, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub