CLEANSTART-2026-EY66530: In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found
CVE-2026-97045 affects multiple packages. In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. See references for individual vulnerability details.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/lokito a version that resolves this vulnerability.Fixed in 3.5.12-r9 - Upgrade
Upgrade
cleanstart/yunikorn-k8shimto a version that resolves this vulnerability.Fixed in 1.8.0-r3 - Upgrade
Upgrade
cleanstart/yunikorn-k8shimto a version that resolves this vulnerability.Fixed in 1.9.0-r1 - Upgrade
Upgrade
cleanstart/prometheus-node-exporterto a version that resolves this vulnerability.Fixed in 1.11.1-r6 - Upgrade
Upgrade
cleanstart/prometheus-node-exporterto a version that resolves this vulnerability.Fixed in 1.9.1-r7
Frequently Asked Questions
Which deployments should be prioritized for review?
Review deployments of cleanstart/yunikorn-k8shim, cleanstart/prometheus-node-exporter, and cleanstart/loki. The provided data states that CVE-2026-97045 affects multiple packages but does not identify affected versions or configurations.
What level of attacker access is indicated by the severity vector?
The vector indicates network-reachable exploitation with low attack complexity, no required privileges, and required user interaction. It also indicates low confidentiality and integrity impact, no availability impact, and a changed scope.
Can the provided information confirm whether a default installation is affected?
No. The available data does not state whether default configurations are affected or describe any configuration prerequisites.
How can I determine whether a deployment is affected?
Confirm whether the deployment uses one of the listed packages, then consult the referenced individual vulnerability details for affected-version information. The provided advisory summary does not include version ranges or detection criteria.