PT-2026-34602 · Dompurify · Dompurify

Published 2026-04-22 · Updated 2026-05-18 · CVE-2026-41238

Positive Technologies (AI Summary)

CVSS v3.1

6.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions DOMPurify versions 3.0.1 through 3.3.3

Description DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. A prototype pollution-based XSS bypass exists when the DOMPurify.sanitize() function is used with the default configuration, specifically when the CUSTOM ELEMENT HANDLING option is not provided. In this scenario, a prototype pollution gadget can inject permissive regex values into Object.prototype for the variables tagNameCheck and attributeNameCheck. This allows arbitrary custom elements and attributes, including event handlers, to bypass sanitization. This issue occurs because the fallback object used for CUSTOM ELEMENT HANDLING inherits from Object.prototype, allowing polluted values to flow into the custom element and attribute validation process.

Recommendations Update DOMPurify to version 3.4.0. As a temporary workaround, provide an explicit CUSTOM ELEMENT HANDLING configuration when calling DOMPurify.sanitize() by setting tagNameCheck and attributeNameCheck to null.

Exploit

Fix

XSS

Prototype Pollution

Weakness Enumeration

CWE-79

CWE-1321

Related Identifiers

CLEANSTART-2026-BE61221

CLEANSTART-2026-LC05413

CVE-2026-41238

GHSA-V9JR-RG53-9PGP

Affected Products

Dompurify

References · 211

• 🔥 https://github.com/cure53/DOMPurify/security/advisories/GHSA-v9jr-rg53-9pgp · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-29087 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42036 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-44457 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-41238 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41240 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-33750 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-33894 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42035 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42041 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-4923 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-33916 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42264 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-0540 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-41238 · Vendor Advisory