{"id":"CVE-2026-41239","sourceIdentifier":"security-advisories@github.com","published":"2026-04-23T16:16:26.560","lastModified":"2026-10-26T21:10:00.170","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Starting in version 1.0.10 and prior to version 3.4.0, `SAFE_FOR_TEMPLATES` strips `{{...}}` expressions from untrusted HTML. This works in string mode but not with `RETURN_DOM` or `RETURN_DOM_FRAGMENT`, allowing XSS via template-evaluating frameworks like Vue 2. Version 3.4.0 patches the issue."},{"lang":"es","value":"DOMPurify es un saneador de cross-site scripting solo para DOM para HTML, MathML y SVG. A partir de la versión 1.0.10 y antes de la versión 3.4.0, “SAFE_FOR_TEMPLATES” elimina las expresiones “{{...}}” del HTML no confiable. Esto funciona en modo cadena pero no con “RETURN_DOM” o “RETURN_DOM_FRAGMENT”, lo que permite XSS a través de frameworks de evaluación de plantillas como Vue 2. La versión 3.4.0 corrige el problema."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"cure53","product":"DOMPurify","versions":[{"version":">= 1.0.10, < 3.4.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-04-25T01:21:32.614113Z","id":"CVE-2026-41239","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-1289"}]}],"references":[{"url":"https://github.com/cure53/DOMPurify/releases/tag/3.4.0","source":"security-advisories@github.com"},{"url":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-crv5-9vww-q3g8","source":"security-advisories@github.com"}]}