Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Prometheus package may mishandle HTML integration points
published 5 days ago
Summary
The Prometheus software library has a flaw in how it processes certain pieces of HTML. When moving up through a document tree, it can stop incorrectly at a nearby element, potentially causing incorrect handling of text nodes. Update to the latest version of the cleanstart/prometheus package to fix the issue.
What to do
- Update cleanstart prometheus to version 3.15.1-r1.
- Update cleanstart prometheus to version 3.15.1-r2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | prometheus |
< 3.15.1-r1 < 3.15.1-r2 Fix: upgrade to 3.15.1-r1
|
Original advisory text
In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found
Security vulnerability affects the prometheus package. In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found.
Timeline
Published30 Oct 2026
Updated31 Oct 2026
First seen31 Oct 2026
Sources
CLEANSTART-2026-BL74630 · OSV
Track software like this
Free during beta