CLEANSTART-2026-YN60892: When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n

Q: Which packages should be prioritized for review?

The affected software listed is cleanstart/tempo and cleanstart/vault. The provided data does not identify affected or fixed versions.

Q: What does the available severity data indicate about exploitation requirements?

The CVSS vector indicates a network-accessible attack with low complexity that does not require attacker privileges or user interaction. It also indicates high confidentiality impact, with no integrity or availability impact listed.

Q: Can the provided information confirm whether a particular deployment is affected?

No. The data identifies the affected packages but provides no version ranges, configuration conditions, or detection indicators.

Published Nov 5, 2026

Updated

CVE-2026-78661 affects multiple packages. When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n. See references for individual vulnerability details.

Affected Software

4 affected componentsFixes available

cleanstart/tempo<2.10.10-r0

2.10.10-r0

cleanstart/tempo<3.0.5-r1

3.0.5-r1

cleanstart/vault<2.0.4-r10

2.0.4-r10

cleanstart/vault<2.0.4-r9

2.0.4-r9

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/tempo to a version that resolves this vulnerability.
Fixed in 2.10.10-r0
Upgrade
Upgrade cleanstart/tempo to a version that resolves this vulnerability.
Fixed in 3.0.5-r1
Upgrade
Upgrade cleanstart/vault to a version that resolves this vulnerability.
Fixed in 2.0.4-r10
Upgrade
Upgrade cleanstart/vault to a version that resolves this vulnerability.
Fixed in 2.0.4-r9

Event History

Nov 5, 2026

Advisory Published

via OSV·12:36 AM

Data Sourced

via OSV·12:36 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-78661

Frequently Asked Questions

Which packages should be prioritized for review?

The affected software listed is cleanstart/tempo and cleanstart/vault. The provided data does not identify affected or fixed versions.

What does the available severity data indicate about exploitation requirements?

The CVSS vector indicates a network-accessible attack with low complexity that does not require attacker privileges or user interaction. It also indicates high confidentiality impact, with no integrity or availability impact listed.

Can the provided information confirm whether a particular deployment is affected?

No. The data identifies the affected packages but provides no version ranges, configuration conditions, or detection indicators.

CLEANSTART-2026-YN60892: When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which packages should be prioritized for review?

What does the available severity data indicate about exploitation requirements?

Can the provided information confirm whether a particular deployment is affected?

Company

Resources

Contact

Frequently Asked Questions

Which packages should be prioritized for review?

What does the available severity data indicate about exploitation requirements?

Can the provided information confirm whether a particular deployment is affected?