OCPBUGS-99040: Fix CVE-2026-49978 - bump DOMPurify to >= 3.4.7#16810
OCPBUGS-99040: Fix CVE-2026-49978 - bump DOMPurify to >= 3.4.7#16810germanparente wants to merge 1 commit into
Conversation
Add dompurify resolution to bump transitive dependency from 3.4.3 to ^3.4.11, fixing DOMPurify IN_PLACE sanitization bypass via attached Shadow Root inside <template>.content (XSS). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
Pipeline controller notification For optional jobs, comment This repository is configured in: LGTM mode |
openshift-ci-robot
added
jira/severity-important
|
@germanparente: This pull request references Jira Issue OCPBUGS-99040, which is valid. The bug has been moved to the POST state. 3 validation(s) were run on this bug
The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
WalkthroughThe frontend package resolutions add ChangesDependency Resolution
Estimated code review effort: 1 (Trivial) | ~2 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 14 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (14 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: germanparente The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
@germanparente: This pull request references Jira Issue OCPBUGS-99040, which is valid. 3 validation(s) were run on this bug
DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@frontend/package.json`:
- Line 228: Update the dompurify dependency declaration in package.json from the
caret range to the exact fixed release 3.4.12, preventing future 3.x updates
when the lockfile is refreshed.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: ba847423-35cc-463d-a67f-b8b68116408e
⛔ Files ignored due to path filters (1)
frontend/yarn.lockis excluded by!**/yarn.lock,!**/*.lock
📒 Files selected for processing (1)
frontend/package.json
| "hosted-git-info": "^3.0.8", | ||
| "protobufjs": "7.5.8" | ||
| "protobufjs": "7.5.8", | ||
| "dompurify": "^3.4.11" |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
rg -n '"dompurify"|dompurify@' frontend/package.json frontend/yarn.lock yarn.lock 2>/dev/null || true
curl -sS -X POST https://api.osv.dev/v1/query \
-H 'Content-Type: application/json' \
-d '{"package":{"name":"dompurify","ecosystem":"npm"},"version":"3.4.12"}' |
jq '.vulns // []'Repository: openshift/console
Length of output: 321
Pin dompurify to the fixed release.
package.json still allows future 3.x updates via ^3.4.11; use the exact 3.4.12 release so the security fix doesn’t drift when the lockfile is refreshed.
Proposed fix
- "dompurify": "^3.4.11"
+ "dompurify": "3.4.12"📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| "dompurify": "^3.4.11" | |
| "dompurify": "3.4.12" |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@frontend/package.json` at line 228, Update the dompurify dependency
declaration in package.json from the caret range to the exact fixed release
3.4.12, preventing future 3.x updates when the lockfile is refreshed.
Source: Path instructions
|
@germanparente: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
openshift-ci
Bot
added
the
needs-rebase
|
PR needs rebase. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
2 participants
Description of the Change
CVE-2026-49978: DOMPurify IN_PLACE sanitization bypass via attached Shadow Root inside
<template>.content(XSS). Affects DOMPurify versions <= 3.4.6.Console has DOMPurify 3.4.3 as a transitive dependency via
monaco-editor. This adds adompurifyyarn resolution to bump it to^3.4.11(resolved to 3.4.12).Jira
OCPBUGS-99040
Screenshots / Screen Recordings
N/A - dependency version bump only, no UI changes.
Testing
yarn.lockresolves dompurify to 3.4.12 (above fix version 3.4.7).Summary by CodeRabbit