Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
cleanstart Loki and Secrets Store driver may render malformed HTML
published 23 days ago
Summary
Both the cleanstart Loki logging system and the cleanstart Secrets Store CSI driver for AWS can accept HTML content that, when processed and displayed, may build an incorrect page structure. This could cause pages to appear wrong or allow unintended code to run in a user's browser. Update the packages to the latest versions that fix the parsing logic, or avoid feeding untrusted HTML into these components.
What to do
- Update cleanstart secrets-store-csi-driver-provider-aws to version 3.1.4-r1.
- Update cleanstart loki to version 3.7.1-r1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | secrets-store-csi-driver-provider-aws |
< 3.1.4-r1 Fix: upgrade to 3.1.4-r1
|
| CleanStart | cleanstart | loki |
< 3.7.1-r1 Fix: upgrade to 3.7.1-r1
|
Original advisory text
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree
CVE-2026-42506 affects multiple packages. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. See references for individual vulnerability details.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Timeline
Published26 Sep 2026
Updated26 Sep 2026
First seen26 Sep 2026
Sources
CLEANSTART-2026-HE86842 · OSV
Track software like this
Free during beta