[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-41240":6},{"stargazers_count":4,"fetched_at":5},7,"2026-08-01T00:21:03.480Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":66,"aliases":76,"duplicate_of":9,"upstream":78,"downstream":79,"duplicates":88,"related":89,"reserved_at":9,"published_at":93,"modified_at":94,"state":95,"summary":96,"references_raw":104,"kevs":138,"epss":139,"epss_history":142,"metrics":362,"affected":376},"CVE-2026-41240","DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Versions prior to 3.4.0 have an inconsistency between FORBID_TAGS and FORBID_ATTR handling when function-based ADD_TAGS is used. Commit c361baa added an early exit for FORBID_ATTR at line 1214. The same fix was not applied to FORBID_TAGS. At line 1118-1123, when EXTRA_ELEMENT_HANDLING.tagCheck returns true, the short-circuit evaluation skips the FORBID_TAGS check entirely. This allows forbidden elements to survive sanitization with their attributes intact. Version 3.4.0 patches the issue.",null,[11,44],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":18,"capec":19},"CWE-79","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.","weakness","Stable","Base","High",[20,24,28,32,36,40],{"id":21,"name":22,"techniques":23},"CAPEC-209","XSS Using MIME Type Mismatch",[],{"id":25,"name":26,"techniques":27},"CAPEC-588","DOM-Based XSS",[],{"id":29,"name":30,"techniques":31},"CAPEC-591","Reflected XSS",[],{"id":33,"name":34,"techniques":35},"CAPEC-592","Stored XSS",[],{"id":37,"name":38,"techniques":39},"CAPEC-63","Cross-Site Scripting (XSS)",[],{"id":41,"name":42,"techniques":43},"CAPEC-85","AJAX Footprinting",[],{"_key":45,"id":45,"name":46,"description":47,"type":15,"status":48,"abstraction":17,"likelihood_of_exploit":9,"capec":49},"CWE-183","Permissive List of Allowed Inputs","The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are explicitly allowed by policy because the inputs are assumed to be safe, but the list is too permissive - that is, it allows an input that is unsafe, leading to resultant weaknesses.","Draft",[50,54,58,62],{"id":51,"name":52,"techniques":53},"CAPEC-120","Double Encoding",[],{"id":55,"name":56,"techniques":57},"CAPEC-3","Using Leading 'Ghost' Character Sequences to Bypass Input Filters",[],{"id":59,"name":60,"techniques":61},"CAPEC-43","Exploiting Multiple Input Interpretation Layers",[],{"id":63,"name":64,"techniques":65},"CAPEC-71","Using Unicode Encoding to Bypass Validation Logic",[],[67],{"_key":68,"name":69,"source":70,"url":71,"maturity":72,"reliability_score":73,"verified":74,"type":9,"platforms":75,"requires_auth":9,"exploitdb":9,"metasploit":9},"GITHUB_CURE53_DOMPURIFY","Dompurify","github","https://github.com/cure53/DOMPurify/security/advisories/GHSA-gx9m-whjm-85jf","poc",0.3,false,[],[77],"GHSA-h7mw-gpvr-xq4m",[],[80,82,84,86],{"_key":81},"UBUNTU-CVE-2026-41240",{"_key":83},"OPENSUSE-SU-2026:10888-1",{"_key":85},"DEBIAN-CVE-2026-41240",{"_key":87},"RHSA-2026:34160",[],[90,91],{"_key":83},{"_key":92},"CGA-V322-X3MP-57W9","2026-04-23T14:54:32.426Z","2026-04-23T17:21:30.547Z","Analyzed",{"cisa_kev":74,"cisa_ransomware":74,"cisa_vendor":9,"epss_severity":97,"epss_score":98,"severity":99,"severity_score":100,"severity_version":101,"severity_source":102,"severity_vector":103,"severity_status":95},"low",0.00263,"medium",6.1,"v3.1","nvd","CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",[105,117,122,129,133],{"url":106,"sources":107,"tags":110},"https://github.com/cure53/DOMPurify/security/advisories/GHSA-h7mw-gpvr-xq4m",[108,109,102],"osv_npm","cve.org",[111,112,113,114,115,116],"WEB","X Refsource CONFIRM","Exploit","Mitigation","Patch","Vendor Advisory",{"url":118,"sources":119,"tags":120},"https://github.com/cure53/DOMPurify",[108],[121],"PACKAGE",{"url":123,"sources":124,"tags":125},"https://github.com/cure53/DOMPurify/releases/tag/3.4.0",[108,109,102],[111,126,127,128],"X Refsource MISC","Product","Release Notes",{"url":130,"sources":131,"tags":132},"https://github.com/cure53/DOMPurify/commit/c361baa18dbdcb3344a41110f4c48ad85bf48f80",[109,102,108],[126,115,111],{"url":134,"sources":135,"tags":136},"https://nvd.nist.gov/vuln/detail/CVE-2026-41240",[108],[137],"Advisory",[],{"date":140,"score":98,"percentile":141},"2026-07-05",0.17748,[143,147,150,153,156,159,163,167,170,173,176,179,182,185,188,191,194,197,200,203,206,209,212,215,218,221,224,227,229,233,236,239,243,246,249,251,254,257,260,263,265,268,272,275,278,281,284,287,289,292,295,298,301,304,307,310,313,316,319,322,325,328,331,334,337,340,343,346,349,352,355,358,361],{"date":144,"score":145,"percentile":146},"2026-04-24",0.00045,0.13604,{"date":148,"score":145,"percentile":149},"2026-04-25",0.136,{"date":151,"score":145,"percentile":152},"2026-04-26",0.13576,{"date":154,"score":145,"percentile":155},"2026-04-27",0.13554,{"date":157,"score":145,"percentile":158},"2026-04-28",0.13495,{"date":160,"score":161,"percentile":162},"2026-04-29",0.00059,0.18152,{"date":164,"score":165,"percentile":166},"2026-04-30",0.00036,0.1045,{"date":168,"score":165,"percentile":169},"2026-05-01",0.10451,{"date":171,"score":165,"percentile":172},"2026-05-02",0.10484,{"date":174,"score":165,"percentile":175},"2026-05-03",0.10469,{"date":177,"score":165,"percentile":178},"2026-05-04",0.10425,{"date":180,"score":165,"percentile":181},"2026-05-05",0.1041,{"date":183,"score":165,"percentile":184},"2026-05-06",0.10405,{"date":186,"score":165,"percentile":187},"2026-05-07",0.10547,{"date":189,"score":165,"percentile":190},"2026-05-08",0.10574,{"date":192,"score":165,"percentile":193},"2026-05-09",0.10614,{"date":195,"score":165,"percentile":196},"2026-05-10",0.1061,{"date":198,"score":165,"percentile":199},"2026-05-11",0.10593,{"date":201,"score":165,"percentile":202},"2026-05-12",0.10636,{"date":204,"score":165,"percentile":205},"2026-05-13",0.10652,{"date":207,"score":165,"percentile":208},"2026-05-14",0.10684,{"date":210,"score":165,"percentile":211},"2026-05-15",0.10689,{"date":213,"score":165,"percentile":214},"2026-05-16",0.10712,{"date":216,"score":165,"percentile":217},"2026-05-17",0.10694,{"date":219,"score":165,"percentile":220},"2026-05-18",0.10646,{"date":222,"score":165,"percentile":223},"2026-05-19",0.10613,{"date":225,"score":165,"percentile":226},"2026-05-20",0.10603,{"date":228,"score":165,"percentile":190},"2026-05-21",{"date":230,"score":231,"percentile":232},"2026-05-22",0.00012,0.01626,{"date":234,"score":231,"percentile":235},"2026-05-23",0.01624,{"date":237,"score":231,"percentile":238},"2026-05-24",0.01628,{"date":240,"score":241,"percentile":242},"2026-05-25",0.00013,0.02004,{"date":244,"score":241,"percentile":245},"2026-05-26",0.01995,{"date":247,"score":241,"percentile":248},"2026-05-27",0.0201,{"date":250,"score":241,"percentile":242},"2026-05-28",{"date":252,"score":241,"percentile":253},"2026-05-29",0.02014,{"date":255,"score":241,"percentile":256},"2026-05-30",0.02038,{"date":258,"score":241,"percentile":259},"2026-05-31",0.02031,{"date":261,"score":241,"percentile":262},"2026-06-01",0.02017,{"date":264,"score":241,"percentile":242},"2026-06-02",{"date":266,"score":241,"percentile":267},"2026-06-03",0.01988,{"date":269,"score":270,"percentile":271},"2026-06-04",0.00017,0.0434,{"date":273,"score":270,"percentile":274},"2026-06-05",0.04357,{"date":276,"score":270,"percentile":277},"2026-06-06",0.04345,{"date":279,"score":270,"percentile":280},"2026-06-07",0.04335,{"date":282,"score":270,"percentile":283},"2026-06-08",0.04308,{"date":285,"score":270,"percentile":286},"2026-06-09",0.04328,{"date":288,"score":270,"percentile":280},"2026-06-10",{"date":290,"score":270,"percentile":291},"2026-06-11",0.04355,{"date":293,"score":270,"percentile":294},"2026-06-12",0.04359,{"date":296,"score":270,"percentile":297},"2026-06-13",0.04347,{"date":299,"score":270,"percentile":300},"2026-06-14",0.04346,{"date":302,"score":98,"percentile":303},"2026-06-15",0.17472,{"date":305,"score":98,"percentile":306},"2026-06-16",0.1749,{"date":308,"score":98,"percentile":309},"2026-06-17",0.17496,{"date":311,"score":98,"percentile":312},"2026-06-18",0.17517,{"date":314,"score":98,"percentile":315},"2026-06-19",0.175,{"date":317,"score":98,"percentile":318},"2026-06-20",0.17489,{"date":320,"score":98,"percentile":321},"2026-06-21",0.17477,{"date":323,"score":98,"percentile":324},"2026-06-22",0.17462,{"date":326,"score":98,"percentile":327},"2026-06-23",0.17508,{"date":329,"score":98,"percentile":330},"2026-06-24",0.17537,{"date":332,"score":98,"percentile":333},"2026-06-25",0.17632,{"date":335,"score":98,"percentile":336},"2026-06-26",0.17662,{"date":338,"score":98,"percentile":339},"2026-06-27",0.17699,{"date":341,"score":98,"percentile":342},"2026-06-28",0.17664,{"date":344,"score":98,"percentile":345},"2026-06-29",0.17653,{"date":347,"score":98,"percentile":348},"2026-06-30",0.17649,{"date":350,"score":98,"percentile":351},"2026-07-01",0.17752,{"date":353,"score":98,"percentile":354},"2026-07-02",0.17724,{"date":356,"score":98,"percentile":357},"2026-07-03",0.17732,{"date":359,"score":98,"percentile":360},"2026-07-04",0.17741,{"date":140,"score":98,"percentile":141},[363,367,370],{"source":108,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":9,"cvss_v4_0":364},{"baseScore":365,"baseSeverity":9,"vectorString":366,"impactScore":9,"exploitabilityScore":9},6,"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",{"source":109,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":9,"cvss_v4_0":368},{"baseScore":365,"baseSeverity":369,"vectorString":366,"impactScore":9,"exploitabilityScore":9},"MEDIUM",{"source":102,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":371,"cvss_v4_0":374},{"baseScore":100,"baseSeverity":369,"vectorString":103,"impactScore":372,"exploitabilityScore":373},4.5,7.2,{"baseScore":365,"baseSeverity":369,"vectorString":375,"impactScore":9,"exploitabilityScore":9},"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",[377,389],{"ecosystem":9,"name":378,"vendor":379,"product":380,"cpe_part":381,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":382},"DOMPurify","cure53","dompurify","a",[383],{"version":384,"is_range":385,"range_type":386,"version_start":9,"version_start_type":9,"version_end":387,"version_end_type":388,"fixed_in":9},"lt3.4.0",true,"cpe","3.4.0","excluding",{"ecosystem":390,"name":380,"vendor":390,"product":380,"cpe_part":9,"purl_type":391,"purl_namespace":9,"purl_name":380,"source":9,"versions":392},"Npm","npm",[393],{"version":394,"is_range":385,"range_type":395,"version_start":9,"version_start_type":9,"version_end":387,"version_end_type":388,"fixed_in":9},"lt3_4_0","semver"]