Back Linuxsecurity

Fedora Prometheus Important XSS Flaws Update 2026

Linuxsecurity •LinuxSecurity Advisories • July 11, 2026

* Thu Jul 2 2026 Mikel Olasagasti Uranga - 3.13.0-1 - Update to 3.13.0 - Closes rhbz#2495979

[ 1 ] Bug #2489191 - CVE-2026-40186 prometheus: ApostropheCMS: sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements [fedora-all] [ 2 ] Bug #2492689 - CVE-2026-44990 prometheus: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass [fedora-all] [ 3 ] Bug #2493575 - CVE-2026-41567 prometheus: Moby/Docker Engine: Arbitrary Code Execution via malicious container image and compressed archive upload [fedora-all] [ 4 ] Bug #2495063 - CVE-2026-53606 prometheus: sanitize-html: Cross-Site Scripting (XSS) via insufficient URI scheme validation [fedora-all] [ 5 ] Bug #2495322 - CVE-2026-25681 prometheus: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting [fedora-all] ...

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-4179e03375' at the command line. For more information, refer to the dnf documentation available at

Get the latest Linux and open source security news straight to your inbox.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical XSS and Code Execution Vulnerabilities in Fedora Prometheus Update On July 2, 2026, Fedora released an update for Prometheus addressing multiple critical vulnerabilities. The update includes fixes for CVE-2026-40186, CVE-2026-44990, CVE-2026-41567, CVE-2026-53606, and CVE-2026-25681. These vulnerabilities allow for various attack vectors, including Cross-Site Scripting (XSS) and arbitrary code execution via malicious container images. The affected systems include Fedora with Prometheus and associated components. Users are urged to update their systems using the 'dnf' package manager. The vulnerabilities were reported by Mikel Olasagasti Uranga and are now patched. The scope of impact is significant, as these flaws could lead to severe security breaches if exploited. The update is critical for maintaining system integrity and security. 2 sources 74

Extracted Entities

Fedora Prometheus Important XSS Flaws Update 2026

The full story

Extracted Entities

Companies (1)

CVEs (5)

CWE Weaknesses (1)

Domains (1)

Vulnerabilities (1)