CVE-2026-41239: cure53 dompurify Cross-site Scripting
CVSS: 6.8v3.1MediumDeferred
AliasesUBUNTU-CVE-2026-41239DEBIAN-CVE-2026-41239CGA-2j53-v6x9-7hv9CGA-8cpx-9wg5-p2vqCGA-rh75-w6mj-6xc8CGA-xw5w-ff45-qqv4GHSA-crv5-9vww-q3g8CGA-22x8-qf3m-4r5xCGA-23j7-87f3-hxj8CGA-26x9-jgfp-fx7hCGA-2787-2wq5-wfxvCGA-2f6j-8h89-27rvCGA-2gr4-w7jh-3x76CGA-2jf8-v87h-7x29CGA-2v34-2pwj-pc74CGA-34jm-qj5v-jx92CGA-34v2-v3x3-x2p4CGA-383v-9rxx-75v2CGA-4725-m9cr-rcfcCGA-4cr8-4vrx-g7qfCGA-4h8w-xhv5-33j7CGA-4wwq-fx84-q9p6CGA-5226-xpfq-qx44CGA-523f-f3w9-96m9CGA-53v3-g8q7-vwcmCGA-58ph-j4xg-fp3vCGA-596q-fwxc-m88wCGA-5jmw-mp8r-r885CGA-62p4-w8x2-gg2rCGA-6cvj-rc7r-9vp8CGA-6fcv-h7mr-g774CGA-75vm-hwc2-7ghpCGA-7753-3vm5-5hpjCGA-78p6-jcx2-fxmpCGA-7fj3-mvgc-636gCGA-84jp-jm3x-r27jCGA-87m5-phrr-xq2jCGA-8pp6-j9j5-489pCGA-939f-2x22-mv6fCGA-9769-3xjf-mgrfCGA-99cc-jxvj-v332CGA-c3mx-jc29-jwgcCGA-cpp9-2356-q76vCGA-cxfj-v33g-fpx7CGA-f5j5-3g65-pjmjCGA-gq68-xj8g-r5m4CGA-grpw-xrp7-5qgrCGA-hh8f-h5qc-ppqpCGA-hmc6-mf37-rw5cCGA-hq42-f93p-qj8jCGA-hqrc-mqxq-jhvjCGA-j2f2-xh7r-ffwjCGA-j8j4-mj37-3r9qCGA-jhfw-v23p-mg6xCGA-jpvw-2xfg-w8xcCGA-m5mj-4pp7-gqqmCGA-mj9w-j7jm-3q7xCGA-mm25-5pjw-262fCGA-mpwr-rh3h-w6xcCGA-pjmp-4wm8-gj3gCGA-pm6r-35rj-7fx4CGA-pqvc-3fv3-5g38CGA-q6gm-2973-xj3gCGA-q8j9-qj54-f62hCGA-qgq4-h53q-742qCGA-qhhg-wqv4-9f97CGA-qv36-6cfv-m4cgCGA-qvwj-8x9v-mjv6CGA-qw9q-c3h9-h7jvCGA-qw9r-j6cw-r2f8CGA-r567-jgr6-wj6hCGA-r8r4-2j8h-9fwrCGA-rqwg-c428-j6r7CGA-v5q9-6wq7-fj75CGA-v862-3xqw-cc4gCGA-vjpm-rgfr-v74vCGA-vv5q-956j-244mCGA-w4c2-r6qm-7j7vCGA-x4vf-3mpp-539gCGA-x8g4-rjc4-r67jCGA-xm28-f6wf-pvgc
Published 23-04-2026Last modified 25-04-2026
Vulnerability summary
CVE-2026-41239 is a medium (CVSS 6.8) Cross-site Scripting vulnerability in cure53 dompurify. EPSS estimates a 0.41% chance of exploitation in the next 30 days, higher than 34.3% of scored vulnerabilities.
CVSS score
6.8/10
010
Medium · v3.1 (CVE.org)EPSS score
0.41%
0%100%
Low · +0.17 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 23-04-2026PublishedVulnerability first disclosed.
- 25-04-2026Last modifiedVulnerability information updated.
Description
DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Starting in version 1.0.10 and prior to version 3.4.0, `SAFE_FOR_TEMPLATES` strips `{{...}}` expressions from untrusted HTML. This works in string mode but not with `RETURN_DOM` or `RETURN_DOM_FRAGMENT`, allowing XSS via template-evaluating frameworks like Vue 2. Version 3.4.0 patches the issue.
CVSS metrics
7 scores · 7 sources · 1 versionMedium 6.8Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:NSourcesAll 7 agree
- OSV · UbuntuEcosystem advisory · calculated6.8MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
- OSV · DebianEcosystem advisory · calculated6.8MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
- OSV · WolfiEcosystem advisory · calculated6.8MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
- OSV · NpmEcosystem advisory · calculated6.8MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
- OSV · ChainguardEcosystem advisory · calculated6.8MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
- NVDNIST6.8MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
EPSS trend
Probability
0.41%
Chance of exploitation in the next 30 days
Percentile
34%
Versus all other CVEs
30-day change
+0.17 pp
From 0.25% on 19-09-2026
19-09-202619-10-2026
EPSS score0.41%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
- CWE-1289Improper Validation of Unsafe Equivalence in InputThe product receives an input value that is used as a resource identifier or other type of reference, but it does not validate or incorrectly validates that the input is equivalent to a potentially-unsafe value.
Affected systems
Chainguard35 products
- airflow-2All versions (No fix recorded)
- airflow-core-2All versions (No fix recorded)
- gitlab-rails-ce-18.1All versions (No fix recorded)
- gitlab-rails-ce-18.10All versions (No fix recorded)
- gitlab-rails-ce-18.11All versions (No fix recorded)
Wolfi2 products
- nextcloud-server-33< 33.0.6-r0
- opensearch-dashboards-3< 3.6.0-r3
Cure531 product
- dompurify≥ 1.0.10, < 3.4.0
Debian1 product
- node-dompurifyAll versions (No fix recorded) | < 3.4.1+dfsg-1
Npm1 product
- dompurify≥ 1.0.10, < 3.4.0
Ubuntu1 product
- node-dompurifyAll versions (No fix recorded)
6 vendors · 41 products
References
8 links- github.com/cure53/DOMPurify/security/advisories/GHSA-crv5-9vww-q3g8X Refsource CONFIRMREPORTAdvisoryWEB
- github.com/cure53/DOMPurifyPACKAGE