From 6f5473034bbe58b04b89d2e9b60807b220f51838 Mon Sep 17 00:00:00 2001
From: German Parente <gparente@redhat.com>
Date: Thu, 23 Jul 2026 17:00:07 +0200
Subject: [PATCH] Fix OCPBUGS-99026: CVE-2026-49978

Add dompurify override to bump transitive dependency from 3.3.0 to
^3.4.11, fixing DOMPurify IN_PLACE sanitization bypass via attached
Shadow Root inside <template>.content (XSS).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 web/package-lock.json | 6 +++---
 web/package.json      | 3 ++-
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/web/package-lock.json b/web/package-lock.json
index 66bddc94c..d81d7c9f9 100644
--- a/web/package-lock.json
+++ b/web/package-lock.json
@@ -12374,9 +12374,9 @@
       }
     },
     "node_modules/dompurify": {
-      "version": "3.3.0",
-      "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.3.0.tgz",
-      "integrity": "sha512-r+f6MYR1gGN1eJv0TVQbhA7if/U7P87cdPl3HN5rikqaBSBxLiCb/b9O+2eG0cxz0ghyU+mU1QkbsOwERMYlWQ==",
+      "version": "3.4.12",
+      "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.12.tgz",
+      "integrity": "sha512-zQvGet8Z2sWbQhCmfFz/T5QWH2oBmjnqK3qvOjaqaNLrLEF912WamU+ohnTp0TCep/MFVHpdJuCZEdFOdTnEFg==",
       "license": "(MPL-2.0 OR Apache-2.0)",
       "optionalDependencies": {
         "@types/trusted-types": "^2.0.7"
diff --git a/web/package.json b/web/package.json
index efea9de73..f75e62d71 100644
--- a/web/package.json
+++ b/web/package.json
@@ -183,7 +183,8 @@
     "sass": {
       "immutable": "^5.1.5"
     },
-    "ws": "^8.21.0"
+    "ws": "^8.21.0",
+    "dompurify": "^3.4.11"
   },
   "consolePlugin": {
     "name": "monitoring-plugin",