PT-2026-42783 · Opensuse+11 · Alloy+140
CVSS v3.1
6.1
Medium
| Vector | AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
The product name cannot be determined (affected versions not specified)
Description
Parsing arbitrary HTML that is subsequently rendered using the
Render function can lead to the creation of an unexpected HTML tree. This behavior can be exploited to perform Cross-Site Scripting (XSS) attacks—a technique where malicious scripts are injected into trusted websites—specifically in applications that attempt to sanitize input HTML before the rendering process.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Clickjacking
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alloy
Apko
Application-Gateway-Kubernetes-Ingress
Argo Cd
Argo Workflows
Azl-Otel-Collector
Buildah
Cadvisor
Calicoctl
Cert-Manager
Cf Cli
Cilium-Cli
Cloud-Provider-Kubevirt
Cloudnativepg
Cni-Plugins
Hashicorp Consul
Kubernetes Containerd
Containerd2
Containerized-Data-Importer
Cortex
Cosign
Cri-O
Cri-Tools
Dasel
Docker Buildx
Docker-Cli-Buildx
Docker Compose
Dracut-Saltboot
Elastic-Beats
Elemental-Operator
Elemental-Toolkit
Etcd
External-Secrets
External Secrets Operator
Gh
Glab
Go-Discover
Golang-Github-Qubitproducts-Exporter Exporter
Golang-Github-Boynux-Squid Exporter
Golang-Github-Lusitaniae-Apache Exporter
Golang-Github-Prometheus-Alertmanager
Golang-Github-Prometheus-Node Exporter
Golang-Github-Prometheus-Prometheus
Golang-Golang-X-Net
Golang-Golang-X-Net-Dev
Golang.Org/X/Net
Golang.Org/X/Net/Html
Gomuks
Google-Guest-Agent
Gostatsd
Govulncheck-Vulndb
Grafana
Grype
Haproxy-Ingress
Hauler
Helm
Helm-Operator
Influxdb
Ingress-Nginx-Controller-1.13
Ingress-Nginx-Controller-1.14
Ingress-Nginx-Controller-1.15
Istio
Keda
Kube-State-Metrics
Kube-Vip
Kube-Vip-Cloud-Provider
Kubernetes
Kubernetes-Csi-External-Provisioner-Fips
Kubernetes-Csi-External-Snapshotter-Fips
Kubernetes-Csi-Livenessprobe-Fips
Kubernetes-Csi-Node-Driver-Registrar
Kubevirt
Kubevirt-1.6
Kubevirt-1.8
Kured
Lux
Mcphost
Memcached-Exporter
Metacontroller
Metallb
Mgr-Push
Mongodb
Mountpoint-S3-Csi-Driver
Multus
Neonmodem
Net
Newrelic-Infrastructure-Agent
Osv-Scanner
Packer
Percona-Server-Mongodb-Operator
Percona-Xtradb-Cluster-Operator-Fips
Podman
Prometheus-Adapter
Prometheus Blackbox Exporter
Prometheus-Postgres Exporter
Promxy-Fips
Python-Defusedxml-Sle15
Rabbitmq-Cluster-Operator
Rabbitmq-Messaging-Topology-Operator
Rclone
Rhnlib
Rootio-Golang.Org/X/Net
Rootlesskit
Runc
Sealed-Secrets
Skopeo
Smarter-Device-Manager
Spacecmd
Spacewalk-Client-Tools
Spice-Server
Spire-Server-Fips
Sriov-Network-Device-Plugin
Supportutils-Plugin-Salt
Supportutils-Plugin-Susemanager-Client
Telegraf
Temporal
Terraform-Provider-Aws
Terraform-Provider-Azurerm
Terraform-Provider-External
Terraform-Provider-Google
Terraform-Provider-Helm
Terraform-Provider-Kubernetes
Terraform-Provider-Local
Terraform-Provider-Null
Terraform-Provider-Random
Terraform-Provider-Tls
Tigera-Operator
Trivy
Trust-Manager
Uyuni-Common-Libs
Uyuni-Tools
Vault
Vault-K8S
Velero
Velero-Plugin-For-Csi
Velociraptor
Wave
Weaviate
Weaviate-Fips
Yq
Zabbix