CLEANSTART-2026-SR18256: When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n
Published Nov 8, 2026
·Updated
CVE-2026-78661 affects multiple packages. When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n. See references for individual vulnerability details.
Affected Software
5 affected componentsFixes available
cleanstart/haproxy-ingress<0.13.21-r1
0.13.21-r1
cleanstart/yunikorn-k8shim<1.10.0-r1
1.10.0-r1
cleanstart/argo-cd<3.4.13-r3
3.4.13-r3
cleanstart/git-lfs<3.7.1-r6
3.7.1-r6
cleanstart/helm<4.3.1-r1
4.3.1-r1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/haproxy-ingressto a version that resolves this vulnerability.Fixed in 0.13.21-r1 - Upgrade
Upgrade
cleanstart/yunikorn-k8shimto a version that resolves this vulnerability.Fixed in 1.10.0-r1 - Upgrade
Upgrade
cleanstart/argo-cdto a version that resolves this vulnerability.Fixed in 3.4.13-r3 - Upgrade
Upgrade
cleanstart/argo-cdto a version that resolves this vulnerability.Fixed in 3.4.13-r4 - Upgrade
Upgrade
cleanstart/git-lfsto a version that resolves this vulnerability.Fixed in 3.7.1-r6 - Upgrade
Upgrade
cleanstart/helmto a version that resolves this vulnerability.Fixed in 4.3.1-r1
Event History
Nov 8, 2026
Advisory Published
via OSV·12:37 AM
Data Sourced
via OSV·12:37 AM
DescriptionSeverityAffected Software