CLEANSTART-2026-ZL00242: In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found

Q: Which deployments should be reviewed?

Review deployments of cleanstart/kafka_exporter, cleanstart/bank-vaults, and cleanstart/prometheus. The provided data does not identify affected or fixed versions.

Q: What level of attacker access is indicated?

The supplied severity vector indicates network attack access, low attack complexity, and no required privileges. It also indicates that user interaction is required.

Q: What is the likely security impact if exploitation succeeds?

The severity vector indicates low confidentiality and integrity impact, no availability impact, and a scope change.

Published Nov 12, 2026

Updated

CVE-2026-97045 affects multiple packages. In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. See references for individual vulnerability details.

Affected Software

3 affected componentsFixes available

cleanstart/kafka_exporter<1.10.0-r0

1.10.0-r0

cleanstart/bank-vaults<1.30.0-r0

1.30.0-r0

cleanstart/prometheus<3.13.5-r0

3.13.5-r0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/kafka_exporter to a version that resolves this vulnerability.
Fixed in 1.10.0-r0
Upgrade
Upgrade cleanstart/bank-vaults to a version that resolves this vulnerability.
Fixed in 1.30.0-r0
Upgrade
Upgrade cleanstart/bank-vaults to a version that resolves this vulnerability.
Fixed in 1.30.0-r1
Upgrade
Upgrade cleanstart/prometheus to a version that resolves this vulnerability.
Fixed in 3.13.5-r0

Event History

Nov 12, 2026

Advisory Published

via OSV·12:37 AM

Data Sourced

via OSV·12:37 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-97045

Frequently Asked Questions

Which deployments should be reviewed?