Skip to content
Fencer Vulns
medium 6.8

CVE-2026-41239 json

DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode

published 2026-04-22 6 mo ago modified 2026-10-26 13 d ago also GHSA-crv5-9vww-q3g8 , EUVD-2026-25237

cvss
6.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 16%
public exploits
0
none known

Summary

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Starting in version 1.0.10 and prior to version 3.4.0, `SAFE_FOR_TEMPLATES` strips `{{...}}` expressions from untrusted HTML. This works in string mode but not with `RETURN_DOM` or `RETURN_DOM_FRAGMENT`, allowing XSS via template-evaluating frameworks like Vue 2. Version 3.4.0 patches the issue.

Patch / fix

  • npm dompurify 3.4.0
  • node-dompurify Debian 14 3.4.1+dfsg-1

debian advisories DEBIAN-CVE-2026-41239

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-41239 updated cvss 6.8

DOMPurify: Vue 2: DOMPurify: Cross-site scripting due to incomplete sanitization of template expressions

  • Red Hat Cryostat 4 dompurify, cryostat-openshift-console-plugin-npm Red Hat Migration Toolkit for Virtualization mtv-candidate/mtv-console-plugin-rhel9, migration-toolkit-virtualization/mtv-console-plugin-rhel9 Red Hat Multicluster Engine for Kubernetes multicluster-engine/console-mce-rhel9 Red Hat Node HealthCheck Operator workload-availability/node-healthcheck-rhel9-operator, workload-availability/node-healthcheck-operator-bundle, workload-availability/node-healthcheck-must-gather-rhel9 Red Hat OpenShift Lightspeed openshift-lightspeed/lightspeed-console-plugin-rhel9, openshift-lightspeed/lightspeed-console-plugin-419-rhel9 Red Hat OpenShift Service Mesh 2 openshift-service-mesh/kiali-ossmc-rhel8
    +24 more products
    Red Hat OpenShift Service Mesh 3 openshift-service-mesh/kiali-rhel9, openshift-service-mesh/kiali-ossmc-rhel9 Red Hat 3scale API Management Platform 2 3scale-amp21/system, 3scale-amp22/system, 3scale-amp2/system-rhel7, 3scale-amp2/system-rhel8, 3scale-amp2/system-rhel9 Red Hat Advanced Cluster Security 4 advanced-cluster-security/rhacs-main-rhel8 Red Hat Ansible Automation Platform 2 automation-gateway, automation-controller, automation-platform-ui, automation-eda-controller, ansible-automation-platform-26/gateway-rhel9 Red Hat build of Apache Camel - HawtIO 4 dompurify Red Hat build of Apicurio Registry 2 dompurify Red Hat build of Apicurio Registry 3 apicurio/apicurio-registry-ui-rhel8, apicurio/apicurio-registry-ui-rhel9 Red Hat Build of Podman Desktop rh-podman-desktop.git Red Hat Ceph Storage 9 rhceph/alloy-rhel10 Red Hat Data Grid 8 dompurify Red Hat Developer Hub 1 rhdh/rhdh-hub-rhel9 Red Hat Enterprise Linux 8 grafana, grafana-loki, grafana-mssql, grafana-mysql, grafana-selinux, grafana-graphite, +8 more Red Hat Enterprise Linux 9 grafana, grafana-selinux Red Hat Enterprise Linux 10 grafana Red Hat OpenShift AI (RHOAI) rhoai/odh-dashboard-rhel8, rhoai/odh-dashboard-rhel9, rhoai/odh-mod-arch-maas-rhel9, rhoai/odh-mod-arch-gen-ai-rhel9, rhoai/odh-mod-arch-model-registry-rhel9 Red Hat OpenShift Container Platform 4 openshift3/ose-console, openshift4/ose-console, openshift4/ose-console-rhel9, openshift4/ose-monitoring-plugin-rhel9 Red Hat Openshift Data Foundation 4 odf4/odf-console-rhel8, odf4/odf-console-rhel9, odf4/ocs-client-console-rhel9, odf4/odf-multicluster-console-rhel8, odf4/odf-multicluster-console-rhel9 Red Hat OpenShift Dev Spaces devspaces/code-rhel9, devspaces/openvsx-rhel9 Red Hat OpenShift GitOps openshift-gitops-1/argocd-rhel8, openshift-gitops-1/argocd-rhel9 Red Hat OpenShift Virtualization 4 container-native-virtualization/kubevirt-console-plugin, container-native-virtualization/kubevirt-console-plugin-rhel9 Red Hat Process Automation 7 dompurify Red Hat Self-service automation portal 2 ansible-automation-platform/automation-portal Red Hat streams for Apache Kafka 2 dompurify Red Hat streams for Apache Kafka 3 dompurify
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Ceph Storage 9.2 rhceph/rhceph-9-rhel10 1790843527
    fixed: vendor fix RHSA-2026:86618
  • Red Hat Ceph Storage 9.2 rhceph/alloy-rhel10 1790774976, rhceph/grafana-rhel10 1790774121, rhceph/keepalived-rhel10 1790842990, rhceph/oauth2-proxy-rhel10 1790774021, rhceph/snmp-notifier-rhel10 1790773439, rhceph/rhceph-haproxy-rhel10 1790846345
    not affected: vulnerable code not present
  • Red Hat Hardened Images ruff
    not affected: component not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
6 mo ago

Exploit prediction

0.25% chance of exploitation in the next 30 days, higher than 16% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
GitHub 3.1 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Affected packages

ecosystem package affected fixed in
npm dompurify
>=1.0.10, <3.4.0
3.4.0

Affected products

  • cure53 DOMPurify

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation
  • CWE-1289 Improper Validation of Unsafe Equivalence in Input

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.