Skip to content

[Aikido] Fix security issue in dompurify via minor version upgrade from 3.4.7 to 3.4.8 in ui#592

Open
aikido-autofix[bot] wants to merge 3 commits into
masterfrom
fix/aikido-security-update-packages-50090469-kgfy
Open

[Aikido] Fix security issue in dompurify via minor version upgrade from 3.4.7 to 3.4.8 in ui#592
aikido-autofix[bot] wants to merge 3 commits into
masterfrom
fix/aikido-security-update-packages-50090469-kgfy

Conversation

@aikido-autofix

Copy link
Copy Markdown
Contributor

Upgrade DOMPurify to fix template injection vulnerability allowing script execution through template literals in SAFE_FOR_TEMPLATES mode.

✅ There are no breaking changes

✅ 1 CVE resolved by this upgrade

This PR will resolve the following CVEs:

Issue Severity           Description
AIKIDO-2026-11156
LOW
[dompurify] A vulnerability allows attackers to inject template expressions (template-literal, mustache, or ERB fragments) into template elements when using specific configuration options, which can be executed as script during downstream template evaluation. The fix ensures expression scrubbing recursively processes template content, similar to shadow-DOM traversal.

@aikido-autofix aikido-autofix Bot added the aikido Label created by Aikido AutoFix label Jun 16, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

aikido Label created by Aikido AutoFix

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants