[Git][security-tracker-team/security-tracker][master] Add CVE-2026-75838/node-dompurify

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
b08d08eb by Salvatore Bonaccorso at 2026-08-19T08:05:35+02:00
Add CVE-2026-75838/node-dompurify

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -154,7 +154,8 @@ CVE-2026-75840 (ArcadeDB before 26.8.1 contains an arbitrary file read vulnerabi
 CVE-2026-75839 (ArcadeDB (com.arcadedb:arcadedb-server) versions <= 26.7.3 contain an  ...)
 	NOT-FOR-US: ArcadeDB
 CVE-2026-75838 (DOMPurify before 3.4.13 contains a cross-site scripting vulnerability  ...)
-	TODO: check
+	- node-dompurify 3.4.13+dfsg-1
+	NOTE: https://github.com/cure53/DOMPurify/security/advisories/GHSA-55q2-fjhq-7xh7
 CVE-2026-75837 (Grav before 2.0.14 fails to guard the access field in the core group b ...)
 	NOT-FOR-US: Grav CMS
 CVE-2026-75836 (The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav's admi ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b08d08ebd1f810bb21ea333a7a26f31e2ad079cb

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b08d08ebd1f810bb21ea333a7a26f31e2ad079cb
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260819/32ffe14e/attachment-0001.htm>