CLEANSTART-2026-TN95778: In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found

Q: What attacker access is indicated by the available severity data?

The supplied vector indicates network-based exploitation with low attack complexity and no required privileges, but it requires user interaction. The data does not specify the form of that interaction.

Q: What security impact is indicated?

The severity data indicates low confidentiality and integrity impact, with no availability impact. It also indicates that the impact can cross a security authority boundary (scope changed).

Q: Which deployments should be assessed first?

Deployments using the cleanstart/kedacore-http-add-on package should be assessed. The provided data does not identify affected versions, fixed versions, configurations, or workarounds.

Published Nov 5, 2026

Updated

Security vulnerability affects the kedacore-http-add-on package. In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found.

Affected Software

1 affected componentFixes available

cleanstart/kedacore-http-add-on<0.15.0-r3

0.15.0-r3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/kedacore-http-add-on to a version that resolves this vulnerability.
Fixed in 0.15.0-r3

Event History

Nov 5, 2026

Advisory Published

via OSV·06:31 AM

Data Sourced

via OSV·06:31 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-97045

Frequently Asked Questions

What attacker access is indicated by the available severity data?

The supplied vector indicates network-based exploitation with low attack complexity and no required privileges, but it requires user interaction. The data does not specify the form of that interaction.

What security impact is indicated?

The severity data indicates low confidentiality and integrity impact, with no availability impact. It also indicates that the impact can cross a security authority boundary (scope changed).

Which deployments should be assessed first?

Deployments using the cleanstart/kedacore-http-add-on package should be assessed. The provided data does not identify affected versions, fixed versions, configurations, or workarounds.

CLEANSTART-2026-TN95778: In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What attacker access is indicated by the available severity data?

What security impact is indicated?

Which deployments should be assessed first?

Company

Resources

Contact

Frequently Asked Questions

What attacker access is indicated by the available severity data?

What security impact is indicated?

Which deployments should be assessed first?