Skip to content
Fencer Vulns
medium 6.1

CVE-2026-0540 json

DOMPurify XSS via Missing Rawtext Elements in SAFE_FOR_XML

published 2026-03-03 8 mo ago modified 2026-09-10 1 mo ago also GHSA-v2wj-7wpq-c8vv , EUVD-2026-9303

cvss
6.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 33%
public exploits
0
none known

Summary

DOMPurify 3.1.3 through 3.3.1 and 2.5.3 through 2.5.8, fixed in commit 2726c74, contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting five missing rawtext elements (noscript, xmp, noembed, noframes, iframe) in the SAFE_FOR_XML regex. Attackers can include payloads like </noscript><img src=x onerror=alert(1)> in attribute values to execute JavaScript when sanitized output is placed inside these unprotected rawtext contexts.

Patch / fix

  • npm dompurify 2.5.9, 3.3.2
  • node-dompurify Debian 14 3.3.2+dfsg-1

debian advisories DEBIAN-CVE-2026-0540

  • cacti openSUSE Tumbleweed 1.2.30+git306.82d5aef5-1.1

opensuse advisories openSUSE-SU-2026:10599-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-0540 updated cvss 6.1

DOMPurify: DOMPurify: Cross-site scripting vulnerability

  • Red Hat Cryostat 4 io.cryostat-cryostat Red Hat Migration Toolkit for Virtualization mtv-candidate/mtv-console-plugin-rhel9, migration-toolkit-virtualization/mtv-console-plugin-rhel9 Red Hat Multicluster Engine for Kubernetes multicluster-engine/console-mce-rhel9 Red Hat Network Observability Operator network-observability/network-observability-console-plugin-compat-rhel9 Red Hat Node HealthCheck Operator workload-availability/node-remediation-console-rhel9, workload-availability/node-healthcheck-rhel9-operator, workload-availability/node-healthcheck-operator-bundle, workload-availability/node-healthcheck-must-gather-rhel9 Red Hat OpenShift Pipelines openshift-pipelines/pipelines-hub-ui-rhel8, openshift-pipelines/pipelines-hub-api-rhel8, openshift-pipelines/pipelines-hub-db-migration-rhel8
    +18 more products
    Red Hat 3scale API Management Platform 2 3scale-amp20/system, 3scale-amp21/system, 3scale-amp22/system, 3scale-amp24/system, 3scale-amp25/system, 3scale-amp26/system, +3 more Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/console-rhel9 Red Hat Advanced Cluster Security 4 advanced-cluster-security/rhacs-main-rhel8 Red Hat Ansible Automation Platform 2 automation-gateway, automation-controller, automation-platform-ui, automation-eda-controller, ansible-automation-platform-26/gateway-rhel9 Red Hat build of Apache Camel - HawtIO 4 io.hawt-project Red Hat build of Apicurio Registry 2 io.apicurio-apicurio-registry Red Hat Enterprise Linux 8 grafana, grafana-loki, grafana-mssql, grafana-mysql, grafana-selinux, grafana-graphite, +8 more Red Hat Enterprise Linux 9 grafana, grafana-selinux Red Hat Enterprise Linux 10 grafana Red Hat OpenShift AI (RHOAI) rhoai/odh-dashboard-rhel9, rhoai/odh-model-registry-rhel8, rhoai/odh-mod-arch-gen-ai-rhel9, rhoai/odh-mod-arch-model-registry-rhel9, rhoai/odh-data-science-pipelines-argo-argoexec-rhel8, rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel8 Red Hat OpenShift Container Platform 4 openshift4/ose-console, openshift4/ose-console-rhel9, openshift4/ose-monitoring-plugin-rhel9 Red Hat Openshift Data Foundation 4 odf4/odf-console-rhel9, odf4/ocs-client-console-rhel9, odf4/odf-multicluster-console-rhel9 Red Hat OpenShift GitOps openshift-gitops-1/argocd-rhel8, openshift-gitops-1/argocd-rhel9, openshift-gitops-1/console-plugin-rhel8 Red Hat OpenShift Virtualization 4 container-native-virtualization/kubevirt-console-plugin, container-native-virtualization/kubevirt-console-plugin-rhel9 Red Hat Process Automation 7 org.kie-process-migration-service Red Hat Self-service automation portal 2 ansible-automation-platform/automation-portal Red Hat streams for Apache Kafka 2 com.github.streamshub-console Red Hat streams for Apache Kafka 3 com.github.streamshub-console
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Ceph Storage 9.2 rhceph/rhceph-9-rhel10 1790843527
    fixed: vendor fix RHSA-2026:86618
  • Red Hat Ceph Storage 9.2 rhceph/alloy-rhel10 1790774976, rhceph/grafana-rhel10 1790774121, rhceph/keepalived-rhel10 1790842990, rhceph/oauth2-proxy-rhel10 1790774021, rhceph/snmp-notifier-rhel10 1790773439, rhceph/rhceph-haproxy-rhel10 1790846345
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
8 mo ago

Exploit prediction

0.39% chance of exploitation in the next 30 days, higher than 33% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CNA 3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CNA 4.0 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
GitHub 3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected packages

ecosystem package affected fixed in
npm dompurify
>=3.1.3, <3.3.2
>=2.5.3, <2.5.9
3.3.2
2.5.9

Affected products

  • cure53 DOMPurify

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.