{"id":"CVE-2026-41238","revision":"c8be66c0b25a48bd835bcb251c043a79","records":[{"revision":"c8be66c0b25a48bd835bcb251c043a79","observedAt":"2026-10-27T10:10:07.342+00:00","statement":{"source":"nvd","id":"CVE-2026-41238","aliases":[],"title":"DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Versions 3.0.1 through 3.3.3 are vulnerable to a prototype pollution-based XSS bypass. When an application uses `DOMPurify.sanitize()` with the default config…","description":"DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Versions 3.0.1 through 3.3.3 are vulnerable to a prototype pollution-based XSS bypass. When an application uses `DOMPurify.sanitize()` with the default configuration (no `CUSTOM_ELEMENT_HANDLING` option), a prior prototype pollution gadget can inject permissive `tagNameCheck` and `attributeNameCheck` regex values into `Object.prototype`, causing DOMPurify to allow arbitrary custom elements with arbitrary attributes — including event handlers — through sanitization. Version 3.4.0 fixes the issue.","state":0,"publishedAt":"2026-04-23T16:16:26.42+00:00","modifiedAt":"2026-10-26T22:10:00.163+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N","score":6.9,"severity":"MEDIUM"}],"references":["https://github.com/cure53/DOMPurify/releases/tag/3.4.0","https://github.com/cure53/DOMPurify/security/advisories/GHSA-v9jr-rg53-9pgp"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-41238","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-79","CWE-1321"],"productCriteria":[],"sourceDates":{"published":"2026-04-23T16:16:26.420","lastModified":"2026-10-26T22:10:00.163"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-41238","identifiers":["CVE-2026-41238"]},"retained":false,"historicalAffected":[]}],"coverage":[]}