CVE-2026-41238: cure53 dompurify Cross-site Scripting
CVSS: 6.9v3.1MediumDeferred
AliasesUBUNTU-CVE-2026-41238DEBIAN-CVE-2026-41238CGA-5428-5wcm-3wrcCGA-hf26-2g56-fwxjCGA-qfh8-c43q-9pggCGA-v4x2-838f-hf95GHSA-v9jr-rg53-9pgpCGA-243w-fcwr-v557CGA-2ff9-27jf-9mw5CGA-2h8w-5fhh-m73xCGA-2q8x-x2fv-v59hCGA-3x37-wc47-x735CGA-426f-3fj4-5gwpCGA-47g2-62f8-qprwCGA-4gw3-w68r-7rjpCGA-4rvg-x5wm-67h6CGA-58xw-2fc4-7rf6CGA-5c33-4php-54h9CGA-5r48-pjxr-xx87CGA-5x38-x9fm-7c9pCGA-62rc-8ccq-q823CGA-65x6-hr33-wwq2CGA-6c6r-9gpr-mqjrCGA-6cx9-gvwh-g3pmCGA-6f6g-mmh3-hvg8CGA-6gm9-qj3r-gmmvCGA-6pf9-8ghj-wh6xCGA-6q62-f5pv-246qCGA-6vcp-2jwm-88whCGA-6xfx-p3gm-8h62CGA-7294-mqcc-3984CGA-72wc-56hh-gpj5CGA-753g-gwhw-4432CGA-79xq-24p6-8cpmCGA-8jqh-62rw-rwc3CGA-92f8-gwh3-8gw4CGA-9j3q-3rcw-p4jfCGA-c7x3-mgh4-q56pCGA-cjhj-9gfm-rc5pCGA-cq8p-cvww-6cjxCGA-crv6-qvgg-f938CGA-cx9p-xpjp-9xpxCGA-f5q5-h844-9mgfCGA-fv8g-ggcm-hx7mCGA-g23p-2326-jmwjCGA-g327-35pj-m5qpCGA-g874-x9r8-669pCGA-gmw2-79jq-h6v7CGA-gqr8-mxrx-w223CGA-gw77-4xqc-36qmCGA-hw77-4jm7-c23pCGA-jf6j-j4v5-m248CGA-jgmf-9fh9-g4v2CGA-jwc3-g9j2-36pmCGA-mc5p-x8mh-h8hmCGA-mfgq-5hqv-9fcfCGA-mvp3-jc86-ggrvCGA-p22r-2fm4-pg89CGA-p3v3-3g2g-v9r4CGA-p8q3-6pcc-4rq7CGA-pmmh-7v59-35chCGA-ppw2-v479-97g3CGA-pxhv-8hc9-jprfCGA-pxjv-j4wr-35rqCGA-qjcp-mvhx-7wq6CGA-qw26-hr47-h3qgCGA-r23m-455x-4x9qCGA-r2g9-3734-hrjxCGA-r3wp-j9hv-v8mhCGA-rpcv-xw2h-hqw9CGA-v3g7-qrc2-4ffwCGA-vf9c-m9m6-h2q7CGA-w567-3pc6-m63hCGA-wg48-r2vx-pg7fCGA-whqg-x8wr-hxx8CGA-x3f4-9gwp-vvgpCGA-x68w-9hx8-m3h8CGA-xcq8-mf98-h82vCGA-xhhw-8h4c-hpv7CGA-xjcj-627p-6pjqCGA-xjgp-5882-gmpw
Published 23-04-2026Last modified 23-04-2026
Vulnerability summary
CVE-2026-41238 is a medium (CVSS 6.9) Cross-site Scripting vulnerability in cure53 dompurify. EPSS estimates a 0.35% chance of exploitation in the next 30 days, higher than 26.6% of scored vulnerabilities.
CVSS score
6.9/10
010
Medium · v3.1 (CVE.org)EPSS score
0.35%
0%100%
Low · +0.12 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 23-04-2026PublishedVulnerability first disclosed.
- 23-04-2026Last modifiedVulnerability information updated.
Description
DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Versions 3.0.1 through 3.3.3 are vulnerable to a prototype pollution-based XSS bypass. When an application uses `DOMPurify.sanitize()` with the default configuration (no `CUSTOM_ELEMENT_HANDLING` option), a prior prototype pollution gadget can inject permissive `tagNameCheck` and `attributeNameCheck` regex values into `Object.prototype`, causing DOMPurify to allow arbitrary custom elements with arbitrary attributes — including event handlers — through sanitization. Version 3.4.0 fixes the issue.
CVSS metrics
7 scores · 7 sources · 1 versionMedium 6.9Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:NSourcesAll 7 agree
- OSV · UbuntuEcosystem advisory · calculated6.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N
- OSV · DebianEcosystem advisory · calculated6.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N
- OSV · WolfiEcosystem advisory · calculated6.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N
- OSV · NpmEcosystem advisory · calculated6.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N
- OSV · ChainguardEcosystem advisory · calculated6.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N
- NVDNIST6.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N
EPSS trend
Probability
0.35%
Chance of exploitation in the next 30 days
Percentile
27%
Versus all other CVEs
30-day change
+0.12 pp
From 0.22% on 19-09-2026
19-09-202619-10-2026
EPSS score0.35%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
- CWE-1321Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Affected systems
Chainguard35 products
- airflow-2All versions (No fix recorded)
- airflow-core-2All versions (No fix recorded)
- gitlab-rails-ce-18.1All versions (No fix recorded)
- gitlab-rails-ce-18.10All versions (No fix recorded)
- gitlab-rails-ce-18.11All versions (No fix recorded)
Wolfi2 products
- nextcloud-server-33< 33.0.6-r0
- opensearch-dashboards-3< 3.6.0-r3
Cure531 product
- dompurify≥ 3.0.1, < 3.4.0
Debian1 product
- node-dompurifyAll versions (No fix recorded) | < 3.4.1+dfsg-1
Npm1 product
- dompurify≥ 3.0.1, < 3.4.0
Ubuntu1 product
- node-dompurifyAll versions (No fix recorded)
6 vendors · 41 products
References
8 links- github.com/cure53/DOMPurify/security/advisories/GHSA-v9jr-rg53-9pgpX Refsource CONFIRMREPORTAdvisoryWEB
- github.com/cure53/DOMPurifyPACKAGE