[Git][security-tracker-team/security-tracker][master] Add new batch of node-dompurify issues

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
b41a4bc2 by Salvatore Bonaccorso at 2026-07-23T22:30:52+02:00
Add new batch of node-dompurify issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -19,13 +19,17 @@ CVE-2026-65917 (CyberPanel through 1.9.1, fixed in commit b198460, contains an i
 CVE-2026-65916 (CyberPanel through 1.9.1, fixed in commit b198460, contains a missing  ...)
 	TODO: check
 CVE-2026-65914 (DOMPurify before 3.3.2 contains a mutation-XSS vulnerability when sani ...)
-	TODO: check
+	- node-dompurify 3.3.2+dfsg-1
+	NOTE: https://github.com/cure53/DOMPurify/security/advisories/GHSA-h8r8-wccr-v5f2
 CVE-2026-65913 (DOMPurify before 3.3.2 contains a prototype pollution vulnerability in ...)
-	TODO: check
+	- node-dompurify 3.3.2+dfsg-1
+	NOTE: https://github.com/cure53/DOMPurify/security/advisories/GHSA-cj63-jhhr-wcxv
 CVE-2026-65912 (DOMPurify before 3.3.2 contains a URI validation bypass vulnerability  ...)
-	TODO: check
+	- node-dompurify 3.3.2+dfsg-1
+	NOTE: https://github.com/cure53/DOMPurify/security/advisories/GHSA-cjmm-f4jc-qw8r
 CVE-2026-65911 (In DOMPurify through 3.3.3, function predicates supplied via ADD_ATTR  ...)
-	TODO: check
+	- node-dompurify 3.4.1+dfsg-1
+	NOTE: https://github.com/cure53/DOMPurify/security/advisories/GHSA-9p3w-6h5p-cv75
 CVE-2026-65908 (In JetBrains PyCharm before 2026.1.4, 2026.2 arbitrary code execution  ...)
 	NOT-FOR-US: JetBrains
 CVE-2026-65907 (In JetBrains TeamCity before 2026.1.2, 2025.11.6 code execution in Git ...)
@@ -33,19 +37,27 @@ CVE-2026-65907 (In JetBrains TeamCity before 2026.1.2, 2025.11.6 code execution
 CVE-2026-65906 (In JetBrains TeamCity before 2026.1.2, 2025.11.6 \u0441ode execution v ...)
 	NOT-FOR-US: JetBrains
 CVE-2026-65904 (DOMPurify through 3.3.3 fails to sanitize DOM elements passed via IN_P ...)
-	TODO: check
+	- node-dompurify 3.4.5+dfsg-1
+	NOTE: https://github.com/cure53/DOMPurify/security/advisories/GHSA-4w3q-35jp-p934
 CVE-2026-65903 (DOMPurify before 3.4.0 contains a logic error in the ADD_TAGS function ...)
-	TODO: check
+	- node-dompurify 3.4.1+dfsg-1
+	NOTE: https://github.com/cure53/DOMPurify/security/advisories/GHSA-39q2-94rc-95cp
 CVE-2026-65902 (DOMPurify before 3.4.7 (affected versions <= 3.4.5) passes direct refe ...)
-	TODO: check
+	- node-dompurify 3.4.12+dfsg-1
+	NOTE: https://github.com/cure53/DOMPurify/security/advisories/GHSA-76mc-f452-cxcm
+	NOTE: Fixed by: https://github.com/cure53/DOMPurify/commit/7996f1dc78eb8b7922388aed75d94a9f8fad9a36
 CVE-2026-65901 (DOMPurify through 3.4.6 contains a cross-site scripting vulnerability  ...)
-	TODO: check
+	- node-dompurify <unfixed>
+	NOTE: https://github.com/cure53/DOMPurify/security/advisories/GHSA-x4vx-rjvf-j5p4
 CVE-2026-65900 (DOMPurify versions >=3.0.0 and before 3.4.8, when configured with SAFE ...)
-	TODO: check
+	- node-dompurify 3.4.12+dfsg-1
+	NOTE: https://github.com/cure53/DOMPurify/security/advisories/GHSA-gvmj-g25r-r7wr
 CVE-2026-65899 (DOMPurify 3.0.0 before 3.4.9 does not reset the retained Trusted Types ...)
-	TODO: check
+	- node-dompurify 3.4.12+dfsg-1
+	NOTE: https://github.com/cure53/DOMPurify/security/advisories/GHSA-vxr8-fq34-vvx9
 CVE-2026-65898 (DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when ...)
-	TODO: check
+	- node-dompurify 3.4.12+dfsg-1
+	NOTE: https://github.com/cure53/DOMPurify/security/advisories/GHSA-cmwh-pvxp-8882
 CVE-2026-65897 (Grav API Plugin versions before 1.0.10 fail to validate the groups fie ...)
 	TODO: check
 CVE-2026-65896 (Grav API Plugin (Composer package getgrav/grav-plugin-api) before 1.0. ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b41a4bc2524ece36a1370c5bf2b5d99599360e21

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b41a4bc2524ece36a1370c5bf2b5d99599360e21
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260723/a9ed5e97/attachment-0001.htm>