The Red Hat security advisory RHSA-2026:58500 reports multiple vulnerabilities in the Red Hat Hardened Images RPMs, including eight CVEs affecting grafana12.4 version 12.4.8-0.1.2.hum1. The primary detailed vulnerability, CVE-2026-65898, involves a flaw in DOMPurify where the ALLOWED_ATTR allowlist is not properly cloned when the setConfig() function is used with an uponSanitizeAttribute hook. This allows an attacker to register a hook that permanently modifies the shared allowlist, enabling conditional allowance of dangerous attributes and resulting in stored cross-site scripting (XSS) and execution of event handlers. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation) and CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes). Red Hat's advisory notes that no suitable mitigation meeting their criteria is currently available, and no official fix has been released yet. The vulnerability has a medium severity rating by Red Hat, with a CVSS 3.1 base score of 5.4 assigned by Red Hat, differing from other sources due to vendor-specific factors.

The primary impact is the potential for stored cross-site scripting (XSS) attacks due to permanent pollution of the attribute allowlist in DOMPurify. This can allow attackers to inject and execute malicious scripts in the context of affected web applications, potentially leading to unauthorized code execution, disclosure of sensitive information such as user cookies, and bypass of protection mechanisms. The vulnerability affects confidentiality and integrity but does not impact availability. The advisory does not report any known exploits in the wild at this time.

Red Hat currently states that no mitigation is available or that existing options do not meet their criteria for ease of use, deployment, applicability, or stability. Users should monitor Red Hat advisories for updates and apply any future patches or updates provided by Red Hat. Until a fix is released, cautious use of the affected functionality and minimizing exposure to untrusted content is advisable.