CLEANSTART-2026-XM90645: In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found
Published Nov 5, 2026
CVE-2026-97045 affects multiple packages. In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. See references for individual vulnerability details.
Affected Software
4 affected componentsFixes available
cleanstart/tempo<2.10.10-r0
2.10.10-r0
cleanstart/tempo<3.0.5-r1
3.0.5-r1
cleanstart/vault<2.0.4-r10
2.0.4-r10
cleanstart/vault<2.0.4-r9
2.0.4-r9
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/tempoto a version that resolves this vulnerability.Fixed in 2.10.10-r0 - Upgrade
Upgrade
cleanstart/tempoto a version that resolves this vulnerability.Fixed in 3.0.5-r1 - Upgrade
Upgrade
cleanstart/vaultto a version that resolves this vulnerability.Fixed in 2.0.4-r10 - Upgrade
Upgrade
cleanstart/vaultto a version that resolves this vulnerability.Fixed in 2.0.4-r9
Event History
Nov 5, 2026
Advisory Published
via OSV·12:36 AM
Data Sourced
via OSV·12:36 AM
DescriptionSeverityAffected Software