CVE-2026-41238

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Versions 3.0.1 through 3.3.3 are vulnerable to a prototype pollution-based XSS bypass. When an application uses `DOMPurify.sanitize()` with the default configuration (no `CUSTOM_ELEMENT_HANDLING` option), a prior prototype pollution gadget can inject permissive `tagNameCheck` and `attributeNameCheck` regex values into `Object.prototype`, causing DOMPurify to allow arbitrary custom elements with arbitrary attributes — including event handlers — through sanitization. Version 3.4.0 fixes the issue.

• CWE-79
• CWE-1321

• https://github.com/cure53/DOMPurify/releases/tag/3.4.0
• https://github.com/cure53/DOMPurify/security/advisories/GHSA-v9jr-rg53-9pgp
• https://github.com/cure53/DOMPurify/security/advisories/GHSA-v9jr-rg53-9pgp

Published

Apr 23, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-41232Froxlor is open source server administration software. Prior…5
• CVE-2026-41233Froxlor is open source server administration software. Prior…5.4
• CVE-2026-41234Froxlor is open source server administration software. Prior…7.6
• CVE-2026-41235Froxlor is open source server administration software. Versi…8.6
• CVE-2026-41236Froxlor is open source server administration software. Versi…8.8
• CVE-2026-41237Froxlor is open source server administration software. In ve…8.6
• CVE-2026-41239DOMPurify is a DOM-only cross-site scripting sanitizer for H…6.8
• CVE-2026-4124The Ziggeo plugin for WordPress is vulnerable to Missing Aut…5.4
• CVE-2026-41240DOMPurify is a DOM-only cross-site scripting sanitizer for H…6.1
• CVE-2026-41241pretalx is a conference planning tool. Prior to 2026.1.0, Th…5.4
• CVE-2026-41242protobufjs compiles protobuf definitions into JavaScript (JS…9.8
• CVE-2026-41243OpenLearn is open-source educational forum software. Prior t…5.4