CLEANSTART-2026-OG47977: JSDom improperly allows the loading of local resources, which allows for local files to be manipulated by a malicious web page when script execution is enabled

Q: What conditions are required for exploitation?

Script execution must be enabled, and a malicious web page must be able to trigger loading of local resources. The CVSS vector indicates network reachability and high attack complexity.

Q: Does an attacker need an account or user interaction?

No privileges and no user interaction are indicated by the CVSS vector (PR:N/UI:N).

Q: What is the potential impact if exploited?

The vulnerability is rated medium severity (5.6) with low confidentiality, integrity, and availability impact. Local files may be manipulated through improper loading of local resources.

Published Nov 11, 2026

Updated

Security vulnerability affects the argo-workflows package. JSDom improperly allows the loading of local resources, which allows for local files to be manipulated by a malicious web page when script execution is enabled.

Affected Software

1 affected componentFixes available

cleanstart/argo-workflows<4.0.15-r2

4.0.15-r2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/argo-workflows to a version that resolves this vulnerability.
Fixed in 4.0.15-r2

Event History

Nov 11, 2026

Advisory Published

via OSV·12:41 AM

Data Sourced

via OSV·12:41 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2021-20066

Frequently Asked Questions

What conditions are required for exploitation?

Script execution must be enabled, and a malicious web page must be able to trigger loading of local resources. The CVSS vector indicates network reachability and high attack complexity.

Does an attacker need an account or user interaction?

No privileges and no user interaction are indicated by the CVSS vector (PR:N/UI:N).

What is the potential impact if exploited?

The vulnerability is rated medium severity (5.6) with low confidentiality, integrity, and availability impact. Local files may be manipulated through improper loading of local resources.

CLEANSTART-2026-OG47977: JSDom improperly allows the loading of local resources, which allows for local files to be manipulated by a malicious web page when script execution is enabled

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What conditions are required for exploitation?

Does an attacker need an account or user interaction?

What is the potential impact if exploited?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required for exploitation?

Does an attacker need an account or user interaction?

What is the potential impact if exploited?