CLEANSTART-2026-II21101: When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n
CVE-2026-78661 affects multiple packages. When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n. See references for individual vulnerability details.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/knative-servingto a version that resolves this vulnerability.Fixed in 1.23.0-r6 - Upgrade
Upgrade
cleanstart/kube-state-metricsto a version that resolves this vulnerability.Fixed in 2.17.0-r12 - Upgrade
Upgrade
cleanstart/rundeckto a version that resolves this vulnerability.Fixed in 6.0.1-r11 - Upgrade
Upgrade
cleanstart/vaultto a version that resolves this vulnerability.Fixed in 2.2.1-r0 - Upgrade
Upgrade
cleanstart/vaultto a version that resolves this vulnerability.Fixed in 2.1.2-r0 - Upgrade
Upgrade
cleanstart/trust-managerto a version that resolves this vulnerability.Fixed in 0.23.0-r5 - Upgrade
Upgrade
cleanstart/knative-net-istioto a version that resolves this vulnerability.Fixed in 1.20.4-r15 - Upgrade
Upgrade
cleanstart/trust-managerto a version that resolves this vulnerability.Fixed in 0.25.0-r1
Event History
Frequently Asked Questions
Which deployments should be reviewed?
Review deployments using cleanstart/vault, cleanstart/trust-manager, cleanstart/knative-serving, cleanstart/kube-state-metrics, cleanstart/rundeck, or cleanstart/knative-net-istio. The provided data does not identify affected or fixed versions.
What access does an attacker need to exploit this issue?
The CVSS vector indicates network-based exploitation with low attack complexity. It requires no privileges and no user interaction.
What is the stated security impact?
The CVSS vector indicates high confidentiality impact, with no stated integrity or availability impact. The issue is rated high severity with a CVSS score of 7.5.