{"id":"EUVD-2026-25238","revision":"0bd5179e10e84ec1a19dca35c78d97b7","records":[{"revision":"0bd5179e10e84ec1a19dca35c78d97b7","observedAt":"2026-10-28T05:07:19.011+00:00","statement":{"source":"euvd","id":"EUVD-2026-25238","aliases":["CVE-2026-41240","GHSA-h7mw-gpvr-xq4m"],"title":"DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Versions prior to 3.4.0 have an inconsistency between FORBID_TAGS and FORBID_ATTR handling when function-based ADD_TAGS is used. Commit c361baa added an early…","description":"DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Versions prior to 3.4.0 have an inconsistency between FORBID_TAGS and FORBID_ATTR handling when function-based ADD_TAGS is used. Commit c361baa added an early exit for FORBID_ATTR at line 1214. The same fix was not applied to FORBID_TAGS. At line 1118-1123, when EXTRA_ELEMENT_HANDLING.tagCheck returns true, the short-circuit evaluation skips the FORBID_TAGS check entirely. This allows forbidden elements to survive sanitization with their attributes intact. Version 3.4.0 patches the issue.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","score":6,"severity":null}],"references":["https://github.com/cure53/DOMPurify/security/advisories/GHSA-h7mw-gpvr-xq4m","https://github.com/cure53/DOMPurify/commit/c361baa18dbdcb3344a41110f4c48ad85bf48f80","https://github.com/cure53/DOMPurify/releases/tag/3.4.0"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-25238","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Apr 23, 2026, 2:54:32 PM","dateUpdated":"Apr 23, 2026, 5:21:30 PM"},"relatedAdvisories":[{"id":"RHSA-2026:27879","title":"Red Hat Security Advisory: OpenShift Virtualization v4.21 Images","vulnerabilityIds":["CVE-2026-41240"]},{"id":"RHSA-2026:27967","title":"Red Hat Security Advisory: OpenShift Virtualization v4.20 Images","vulnerabilityIds":["CVE-2026-41240"]},{"id":"RHSA-2026:34608","title":"Red Hat Security Advisory: Streams for Apache Kafka 2.9.4 release and security update","vulnerabilityIds":["CVE-2024-29371","CVE-2025-13465","CVE-2025-58056","CVE-2026-1002","CVE-2026-4800","CVE-2026-6860","CVE-2026-23864","CVE-2026-24281","CVE-2026-24308","CVE-2026-27980","CVE-2026-33870","CVE-2026-33871","CVE-2026-34480","CVE-2026-39852","CVE-2026-41240","CVE-2026-42044","CVE-2026-42583","CVE-2026-42587","CVE-2026-44249","CVE-2026-44573","CVE-2026-44574","CVE-2026-44575","CVE-2026-44577","CVE-2026-44578","CVE-2026-44579","CVE-2026-44893","CVE-2026-45109","CVE-2026-45416","CVE-2026-45674","CVE-2026-47691","CVE-2026-48043","CVE-2026-48059","CVE-2026-50010","CVE-2026-50559"]},{"id":"WID-SEC-W-2026-2892","title":"Oracle Construction and Engineering: Schwachstelle gefährdet Vertraulichkeit und Integrität","vulnerabilityIds":["CVE-2026-41240"]},{"id":"WID-SEC-W-2026-3046","title":"IBM Concert: Mehrere Schwachstellen","vulnerabilityIds":["CVE-2019-19921","CVE-2021-23337","CVE-2024-3651","CVE-2024-39338","CVE-2024-45590","CVE-2025-13465","CVE-2025-15284","CVE-2025-15599","CVE-2025-22874","CVE-2025-47273","CVE-2025-47907","CVE-2025-52881","CVE-2025-53643","CVE-2025-55184","CVE-2025-58056","CVE-2025-58188","CVE-2025-58189","CVE-2025-61723","CVE-2025-61730","CVE-2025-64649","CVE-2025-64756","CVE-2025-67221","CVE-2025-68121","CVE-2025-68146","CVE-2026-0540","CVE-2026-2327","CVE-2026-23490","CVE-2026-23897","CVE-2026-2391","CVE-2026-23949","CVE-2026-24486","CVE-2026-25528","CVE-2026-25547","CVE-2026-25639","CVE-2026-25990","CVE-2026-26007","CVE-2026-26019","CVE-2026-26996","CVE-2026-27142","CVE-2026-27212","CVE-2026-27699","CVE-2026-27903","CVE-2026-27904","CVE-2026-28684","CVE-2026-29063","CVE-2026-29181","CVE-2026-2950","CVE-2026-31808","CVE-2026-31900","CVE-2026-32274","CVE-2026-32288","CVE-2026-32597","CVE-2026-32630","CVE-2026-32887","CVE-2026-32952","CVE-2026-33186","CVE-2026-33532","CVE-2026-33750","CVE-2026-33814","CVE-2026-33816","CVE-2026-33916","CVE-2026-34043","CVE-2026-34073","CVE-2026-34077","CVE-2026-3520","CVE-2026-35469","CVE-2026-35515","CVE-2026-3627","CVE-2026-39823","CVE-2026-39825","CVE-2026-39826","CVE-2026-39892","CVE-2026-39984","CVE-2026-40175","CVE-2026-40179","CVE-2026-40181","CVE-2026-40190","CVE-2026-40347","CVE-2026-41066","CVE-2026-41182","CVE-2026-41238","CVE-2026-41239","CVE-2026-41240","CVE-2026-41305","CVE-2026-41324","CVE-2026-41425","CVE-2026-41481","CVE-2026-41488","CVE-2026-41602","CVE-2026-41636","CVE-2026-42151","CVE-2026-42154","CVE-2026-42198","CVE-2026-42211","CVE-2026-42338","CVE-2026-42342","CVE-2026-42561","CVE-2026-42577","CVE-2026-43870","CVE-2026-44405","CVE-2026-44431","CVE-2026-44432","CVE-2026-44486","CVE-2026-44487","CVE-2026-44488","CVE-2026-44492","CVE-2026-44494","CVE-2026-44496","CVE-2026-44728","CVE-2026-4539","CVE-2026-45409","CVE-2026-45736","CVE-2026-46625","CVE-2026-4800","CVE-2026-4923","CVE-2026-4926","CVE-2026-7246","CVE-2026-8723"]},{"id":"RHSA-2026:27875","title":"Red Hat Security Advisory: OpenShift Virtualization v4.18 Images","vulnerabilityIds":["CVE-2026-41240"]},{"id":"RHSA-2026:36107","title":"Red Hat Security Advisory: OpenShift Virtualization v4.15 Images","vulnerabilityIds":["CVE-2026-41240","CVE-2026-42044"]},{"id":"RHSA-2026:27872","title":"Red Hat Security Advisory: OpenShift Virtualization v4.19 Images","vulnerabilityIds":["CVE-2026-41240"]},{"id":"RHSA-2026:22619","title":"Red Hat Security Advisory: Red Hat Data Grid 8.6.1 security update","vulnerabilityIds":["CVE-2026-4800","CVE-2026-33870","CVE-2026-33871","CVE-2026-34478","CVE-2026-34480","CVE-2026-34481","CVE-2026-40975","CVE-2026-41240","CVE-2026-42033","CVE-2026-42039","CVE-2026-42041","CVE-2026-42043"]},{"id":"openSUSE-SU-2026:10888-1","title":"argocd-cli-3.4.3-1.1 on GA media","vulnerabilityIds":["CVE-2026-41240"]},{"id":"RHSA-2026:24977","title":"Red Hat Security Advisory: RHOAI 2.25.7 - Red Hat OpenShift AI","vulnerabilityIds":["CVE-2025-14813","CVE-2025-48956","CVE-2025-61726","CVE-2025-62718","CVE-2025-69227","CVE-2025-69228","CVE-2026-1462","CVE-2026-4800","CVE-2026-6321","CVE-2026-23490","CVE-2026-24747","CVE-2026-25048","CVE-2026-25960","CVE-2026-27489","CVE-2026-27893","CVE-2026-28500","CVE-2026-28684","CVE-2026-29063","CVE-2026-29074","CVE-2026-31958","CVE-2026-32280","CVE-2026-32597","CVE-2026-32981","CVE-2026-33186","CVE-2026-33231","CVE-2026-34986","CVE-2026-34993","CVE-2026-39892","CVE-2026-40192","CVE-2026-40895","CVE-2026-41240","CVE-2026-41242","CVE-2026-42033","CVE-2026-42035","CVE-2026-42039","CVE-2026-42041","CVE-2026-42043"]},{"id":"RHSA-2026:86618","title":"Red Hat Security Advisory: New container image: rhceph-9.2","vulnerabilityIds":["CVE-2023-46159","CVE-2024-47866","CVE-2024-48916","CVE-2024-55565","CVE-2025-12816","CVE-2025-15599","CVE-2025-26791","CVE-2025-30156","CVE-2025-50181","CVE-2025-50182","CVE-2025-58754","CVE-2025-59343","CVE-2025-62718","CVE-2025-66030","CVE-2025-66035","CVE-2025-66412","CVE-2025-69873","CVE-2026-0540","CVE-2026-21441","CVE-2026-22610","CVE-2026-25639","CVE-2026-26996","CVE-2026-27903","CVE-2026-27904","CVE-2026-27970","CVE-2026-32141","CVE-2026-33228","CVE-2026-33671","CVE-2026-33672","CVE-2026-33891","CVE-2026-33894","CVE-2026-33895","CVE-2026-33896","CVE-2026-39865","CVE-2026-40175","CVE-2026-40895","CVE-2026-41238","CVE-2026-41239","CVE-2026-41240","CVE-2026-41305","CVE-2026-42033","CVE-2026-42034","CVE-2026-42035","CVE-2026-42036","CVE-2026-42037","CVE-2026-42038","CVE-2026-42039","CVE-2026-42040","CVE-2026-42041","CVE-2026-42042","CVE-2026-42043","CVE-2026-42044","CVE-2026-50152","CVE-2026-58224"]},{"id":"RHSA-2026:34160","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update","vulnerabilityIds":["CVE-2026-6322","CVE-2026-33154","CVE-2026-41240","CVE-2026-42035","CVE-2026-42784","CVE-2026-44293","CVE-2026-44431","CVE-2026-44432","CVE-2026-44488","CVE-2026-44495","CVE-2026-48526"]},{"id":"WID-SEC-W-2026-1407","title":"IBM App Connect Enterprise Certified Container: Mehrere Schwachstellen","vulnerabilityIds":["CVE-2026-26013","CVE-2026-27142","CVE-2026-28277","CVE-2026-28684","CVE-2026-32288","CVE-2026-33151","CVE-2026-33349","CVE-2026-33532","CVE-2026-33891","CVE-2026-33894","CVE-2026-33895","CVE-2026-33896","CVE-2026-33916","CVE-2026-34601","CVE-2026-35469","CVE-2026-39406","CVE-2026-39407","CVE-2026-39408","CVE-2026-39409","CVE-2026-39410","CVE-2026-39983","CVE-2026-40175","CVE-2026-40347","CVE-2026-40895","CVE-2026-41238","CVE-2026-41239","CVE-2026-41240","CVE-2026-4923","CVE-2026-4926"]},{"id":"RHSA-2026:36108","title":"Red Hat Security Advisory: OpenShift Virtualization v4.13 Images","vulnerabilityIds":["CVE-2026-41240","CVE-2026-44492","CVE-2026-44494","CVE-2026-44495"]},{"id":"RHSA-2026:59360","title":"Red Hat Security Advisory: Apicurio Registry (container images) release and security update [ 3.3.1 GA ]","vulnerabilityIds":["CVE-2026-12975","CVE-2026-12992","CVE-2026-12993","CVE-2026-41240","CVE-2026-44496","CVE-2026-49978"]},{"id":"RHSA-2026:28010","title":"Red Hat Security Advisory: Red Hat build of Cryostat security update","vulnerabilityIds":["CVE-2025-48431","CVE-2026-9277","CVE-2026-32281","CVE-2026-41240","CVE-2026-42578","CVE-2026-42579","CVE-2026-42581","CVE-2026-42584","CVE-2026-42587","CVE-2026-43869"]},{"id":"RHSA-2026:21338","title":"Red Hat Security Advisory: Red Hat Developer Hub 1.8.7 release.","vulnerabilityIds":["CVE-2026-6321","CVE-2026-32280","CVE-2026-32281","CVE-2026-32282","CVE-2026-40895","CVE-2026-41240","CVE-2026-41242","CVE-2026-41674","CVE-2026-42033","CVE-2026-42035","CVE-2026-42039","CVE-2026-42041","CVE-2026-42043","CVE-2026-42044"]},{"id":"RHSA-2026:16476","title":"Red Hat Security Advisory: Kiali 1.73.30 for Red Hat OpenShift Service Mesh 2.6","vulnerabilityIds":["CVE-2026-32280","CVE-2026-40895","CVE-2026-41240","CVE-2026-42033","CVE-2026-42035","CVE-2026-42039","CVE-2026-42041","CVE-2026-42043"]},{"id":"RHSA-2026:27944","title":"Red Hat Security Advisory: OpenShift Virtualization v4.14 Images","vulnerabilityIds":["CVE-2026-41240","CVE-2026-44495"]},{"id":"RHSA-2026:21772","title":"Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.28.0 Release.","vulnerabilityIds":["CVE-2025-14813","CVE-2025-68121","CVE-2026-0636","CVE-2026-1525","CVE-2026-1526","CVE-2026-1528","CVE-2026-1605","CVE-2026-2229","CVE-2026-2327","CVE-2026-5588","CVE-2026-26996","CVE-2026-27904","CVE-2026-29074","CVE-2026-30827","CVE-2026-31802","CVE-2026-32141","CVE-2026-32280","CVE-2026-32282","CVE-2026-32305","CVE-2026-33252","CVE-2026-33810","CVE-2026-34742","CVE-2026-35051","CVE-2026-39858","CVE-2026-40477","CVE-2026-40478","CVE-2026-40611","CVE-2026-40895","CVE-2026-40912","CVE-2026-40972","CVE-2026-40973","CVE-2026-40975","CVE-2026-41240","CVE-2026-42033","CVE-2026-42035","CVE-2026-42039","CVE-2026-42041","CVE-2026-42043","CVE-2026-42044"]},{"id":"RHSA-2026:28001","title":"Red Hat Security Advisory: OpenShift Virtualization v4.17 Images","vulnerabilityIds":["CVE-2026-41240"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-25238","identifiers":["EUVD-2026-25238","CVE-2026-41240","GHSA-h7mw-gpvr-xq4m"]},"retained":false,"historicalAffected":[]}],"coverage":[]}