Skip to content
Fencer Vulns
medium 6.9

CVE-2026-41238 json

DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING Fallback

published 2026-04-22 6 mo ago modified 2026-10-26 13 d ago also GHSA-v9jr-rg53-9pgp , EUVD-2026-25236

cvss
6.9
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 19%
public exploits
0
none known

Summary

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Versions 3.0.1 through 3.3.3 are vulnerable to a prototype pollution-based XSS bypass. When an application uses `DOMPurify.sanitize()` with the default configuration (no `CUSTOM_ELEMENT_HANDLING` option), a prior prototype pollution gadget can inject permissive `tagNameCheck` and `attributeNameCheck` regex values into `Object.prototype`, causing DOMPurify to allow arbitrary custom elements with arbitrary attributes — including event handlers — through sanitization. Version 3.4.0 fixes the issue.

Patch / fix

  • npm dompurify 3.4.0
  • node-dompurify Debian 14 3.4.1+dfsg-1

debian advisories DEBIAN-CVE-2026-41238

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-41238 updated cvss 6.8

DOMPurify: DOMPurify: Cross-Site Scripting bypass via prototype pollution

  • Red Hat Cryostat 4 dompurify, cryostat-openshift-console-plugin-npm Red Hat Migration Toolkit for Virtualization mtv-candidate/mtv-console-plugin-rhel9, migration-toolkit-virtualization/mtv-console-plugin-rhel9 Red Hat Multicluster Engine for Kubernetes multicluster-engine/console-mce-rhel9 Red Hat Node HealthCheck Operator workload-availability/node-healthcheck-rhel9-operator, workload-availability/node-healthcheck-operator-bundle, workload-availability/node-healthcheck-must-gather-rhel9 Red Hat OpenShift Lightspeed openshift-lightspeed/lightspeed-console-plugin-rhel9, openshift-lightspeed/lightspeed-console-plugin-419-rhel9 Red Hat OpenShift Service Mesh 2 openshift-service-mesh/kiali-ossmc-rhel8
    +24 more products
    Red Hat OpenShift Service Mesh 3 openshift-service-mesh/kiali-rhel9, openshift-service-mesh/kiali-ossmc-rhel9 Red Hat 3scale API Management Platform 2 3scale-amp21/system, 3scale-amp22/system, 3scale-amp2/system-rhel7, 3scale-amp2/system-rhel8, 3scale-amp2/system-rhel9 Red Hat Advanced Cluster Security 4 advanced-cluster-security/rhacs-main-rhel8 Red Hat Ansible Automation Platform 2 automation-gateway, automation-controller, automation-platform-ui, automation-eda-controller, ansible-automation-platform-26/gateway-rhel9 Red Hat build of Apache Camel - HawtIO 4 dompurify Red Hat build of Apicurio Registry 2 dompurify Red Hat build of Apicurio Registry 3 apicurio/apicurio-registry-ui-rhel8, apicurio/apicurio-registry-ui-rhel9 Red Hat Build of Podman Desktop rh-podman-desktop.git Red Hat Ceph Storage 9 rhceph/alloy-rhel10 Red Hat Data Grid 8 dompurify Red Hat Developer Hub 1 rhdh/rhdh-hub-rhel9 Red Hat Enterprise Linux 8 grafana, grafana-loki, grafana-mssql, grafana-mysql, grafana-selinux, grafana-graphite, +8 more Red Hat Enterprise Linux 9 grafana, grafana-selinux Red Hat Enterprise Linux 10 grafana Red Hat OpenShift AI (RHOAI) rhoai/odh-dashboard-rhel8, rhoai/odh-dashboard-rhel9, rhoai/odh-mod-arch-maas-rhel9, rhoai/odh-mod-arch-gen-ai-rhel9, rhoai/odh-mod-arch-model-registry-rhel9 Red Hat OpenShift Container Platform 4 openshift3/ose-console, openshift4/ose-console, openshift4/ose-console-rhel9, openshift4/ose-monitoring-plugin-rhel9 Red Hat Openshift Data Foundation 4 odf4/odf-console-rhel8, odf4/odf-console-rhel9, odf4/ocs-client-console-rhel9, odf4/odf-multicluster-console-rhel8, odf4/odf-multicluster-console-rhel9 Red Hat OpenShift Dev Spaces devspaces/code-rhel9, devspaces/openvsx-rhel9 Red Hat OpenShift GitOps openshift-gitops-1/argocd-rhel8, openshift-gitops-1/argocd-rhel9 Red Hat OpenShift Virtualization 4 container-native-virtualization/kubevirt-console-plugin, container-native-virtualization/kubevirt-console-plugin-rhel9 Red Hat Process Automation 7 dompurify Red Hat Self-service automation portal 2 ansible-automation-platform/automation-portal Red Hat streams for Apache Kafka 2 dompurify Red Hat streams for Apache Kafka 3 dompurify
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Ceph Storage 9.2 rhceph/rhceph-9-rhel10 1790843527
    fixed: vendor fix RHSA-2026:86618
  • Red Hat Ceph Storage 9.2 rhceph/alloy-rhel10 1790774976, rhceph/grafana-rhel10 1790774121, rhceph/keepalived-rhel10 1790842990, rhceph/oauth2-proxy-rhel10 1790774021, rhceph/snmp-notifier-rhel10 1790773439, rhceph/rhceph-haproxy-rhel10 1790846345 Red Hat Hardened Images ruff
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
6 mo ago

Exploit prediction

0.27% chance of exploitation in the next 30 days, higher than 19% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/cure53/DOMPurify/security/advisories/GHSA-v9jr-rg53-9pgp referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 6.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N
GitHub 3.1 6.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N

Affected packages

ecosystem package affected fixed in
npm dompurify
>=3.0.1, <3.4.0
3.4.0

Affected products

  • cure53 DOMPurify

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation
  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.