CLEANSTART-2026-RT98327: In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found
CVE-2026-97045 affects multiple packages. In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. See references for individual vulnerability details.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/knative-servingto a version that resolves this vulnerability.Fixed in 1.23.0-r6 - Upgrade
Upgrade
cleanstart/kube-state-metricsto a version that resolves this vulnerability.Fixed in 2.17.0-r12 - Upgrade
Upgrade
cleanstart/rundeckto a version that resolves this vulnerability.Fixed in 6.0.1-r11 - Upgrade
Upgrade
cleanstart/vaultto a version that resolves this vulnerability.Fixed in 2.2.1-r0 - Upgrade
Upgrade
cleanstart/vaultto a version that resolves this vulnerability.Fixed in 2.1.2-r0 - Upgrade
Upgrade
cleanstart/trust-managerto a version that resolves this vulnerability.Fixed in 0.23.0-r5 - Upgrade
Upgrade
cleanstart/knative-net-istioto a version that resolves this vulnerability.Fixed in 1.20.4-r15 - Upgrade
Upgrade
cleanstart/trust-managerto a version that resolves this vulnerability.Fixed in 0.25.0-r1
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The issue is rated network-accessible with low attack complexity and requires no privileges. Exploitation requires user interaction.
What is the expected security impact?
The provided vector indicates low confidentiality and integrity impact, with no availability impact. It also indicates that the impact crosses a security authority boundary (scope changed).
Which CleanStart packages are listed in connection with this issue?
The listed packages are cleanstart/vault, cleanstart/trust-manager, cleanstart/knative-serving, cleanstart/kube-state-metrics, cleanstart/rundeck, and cleanstart/knative-net-istio.