CVE-2026-27136
Medium · 6.1CVSS
6.1
EPSS
0.2%
Published
May 22, 2026
CISA due date
—
The record
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | grafana | 0 | 11.6.14+security04-bp160.2.1 |
| openSUSE:Leap 16.0 | mcphost | 0 | 0.34.0-160000.2.1 |
| openSUSE:Leap 16.0 | neonmodem | 0 | 1.0.7+git0.346d1d3-bp160.1.1 |
| openSUSE:Leap 16.0 | trivy | 0 | 0.71.0-160000.1.1 |
| openSUSE:Tumbleweed | mcphost | 0 | 0.34.0-8.1 |
| openSUSE:Tumbleweed | rclone | 0 | 1.74.2-1.1 |
| openSUSE:Tumbleweed | trivy | 0 | 0.71.0-1.1 |
| openSUSE:Tumbleweed | velociraptor | 0 | 0.7.0.4.git185.a5708584-2.1 |
| openSUSE:Tumbleweed | yq | 0 | 4.53.2-2.1 |
Related vulnerabilities
- CVE-2026-39821 The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that… Also affects grafana
- CVE-2026-42506 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected… Also affects grafana
- CVE-2026-42502 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected… Also affects grafana
- CVE-2026-25681 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected… Also affects grafana
- CVE-2026-25680 Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of… Also affects grafana
- CVE-2026-28380 Any Editor could delete any snapshot, even if they have no access to read or write them. Also affects grafana
- CVE-2026-28383 A request to the Grafana plugin resources endpoint can cause unbounded memory allocation… Also affects grafana
- CVE-2026-33378 Using the $__timeGroup macro, one can achieve an OOM by overloading the server. Also affects grafana