python313-comfyui-frontend-package-1.52.7-1.1 on GA media

CVE-2026-65898 is a cross-site scripting vulnerability in DOMPurify, a library used in Red Hat Hardened Images RPMs, specifically affecting grafana12.4 packages. The vulnerability arises because the ALLOWED_ATTR allowlist is not properly cloned when the setConfig() function is used with an uponSanitizeAttribute hook. This allows an attacker to permanently mutate the shared allowlist, enabling conditional allowance of dangerous attributes. Consequently, untrusted content can inherit the polluted allowlist, leading to stored XSS and execution of event handlers. Red Hat has published an advisory detailing this issue and the affected packages but currently does not offer a remediation that meets their standards.

The vulnerability allows attackers to perform stored cross-site scripting attacks by injecting malicious attributes that are conditionally allowed due to the polluted allowlist. This can lead to execution of unauthorized scripts in the context of users visiting affected applications, potentially compromising confidentiality and integrity by stealing cookies, session tokens, or executing arbitrary code in the victim's browser. The impact is rated medium by Red Hat, reflecting the potential for unauthorized code execution and data exposure via XSS.

Red Hat currently does not provide an official fix or mitigation that meets their criteria for ease of deployment and applicability. Users should monitor Red Hat advisories for updates. Until a fix is available, consider restricting the use of the setConfig() function with uponSanitizeAttribute hooks in DOMPurify or applying application-level controls to sanitize inputs and outputs. Follow Red Hat's guidance at https://images.redhat.com/ for updates and instructions.