CVE-2026-41239
published 2026-04-23CVE-2026-41239: DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Starting in version 1.0.10 and prior to version 3.4.0, `SAFE_FOR_TEMPLATES`…
PriorityP431medium6.8CVSS 3.1
AVNACHPRNUIRSUCHIHAN
EPSS
0.41%
34.7th percentile
DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Starting in version 1.0.10 and prior to version 3.4.0, `SAFE_FOR_TEMPLATES` strips `{{...}}` expressions from untrusted HTML. This works in string mode but not with `RETURN_DOM` or `RETURN_DOM_FRAGMENT`, allowing XSS via template-evaluating frameworks like Vue 2. Version 3.4.0 patches the issue.
Affected
47 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| 3scale-amp2 | system-rhel7 | — | — |
| 3scale-amp2 | system-rhel8 | — | — |
| 3scale-amp2 | system-rhel9 | — | — |
| 3scale-amp21 | system | — | — |
| 3scale-amp22 | system | — | — |
| advanced-cluster-security | rhacs-main-rhel8 | — | — |
| ansible-automation-platform-26 | gateway-rhel9 | — | — |
| ansible-automation-platform | automation-portal | — | — |
| apicurio | apicurio-registry-ui-rhel8 | — | — |
| apicurio | apicurio-registry-ui-rhel9 | — | — |
| container-native-virtualization | kubevirt-console-plugin | — | — |
| container-native-virtualization | kubevirt-console-plugin-rhel9 | — | — |
| cure53 | dompurify | — | — |
| cure53 | dompurify | — | — |
| cure53 | dompurify | >= 1.0.10 < 3.4.0 | 3.4.0 |
| devspaces | code-rhel9 | — | — |
| devspaces | openvsx-rhel9 | — | — |
| grafana | grafana | — | — |
| migration-toolkit-virtualization | mtv-console-plugin-rhel9 | — | — |
| mtv-candidate | mtv-console-plugin-rhel9 | — | — |
| multicluster-engine | console-mce-rhel9 | — | — |
| odf4 | ocs-client-console-rhel9 | — | — |
| odf4 | odf-console-rhel8 | — | — |
| odf4 | odf-console-rhel9 | — | — |
| odf4 | odf-multicluster-console-rhel8 | — | — |
CVSS provenance
nvdv3.16.8MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
vendor_redhat6.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
cure53 DOMPurify up to 3.3.x cross site scripting
vuldb·2026-04-23·CVSS 6.8
CVE-2026-41239 [MEDIUM] cure53 DOMPurify up to 3.3.x cross site scripting
A vulnerability classified as problematic has been found in cure53 DOMPurify up to 3.3.x. Impacted is an unknown function. This manipulation causes cross site scripting.
This vulnerability is registered as CVE-2026-41239. Remote exploitation of the attack is possible. No exploit is available.
It is recommended to upgrade the affected component.
GHSA
DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode
ghsa·2026-04-22
CVE-2026-41239 [MEDIUM] CWE-1289 DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode
DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode
## Summary
| Field | Value |
|:------|:------|
| **Severity** | Medium |
| **Affected** | DOMPurify `main` at [`883ac15`](https://github.com/cure53/DOMPurify/tree/883ac15d47f907cb1a3b5a152fe90c4d8c10f9e6), introduced in v1.0.10 ([`7fc196db`](https://github.com/cure53/DOMPurify/commit/7fc196db0b42a0c360262dba0cc39c9c91bfe1ec)) |
`SAFE_FOR_TEMPLATES` strips `{{...}}` expressions from untrusted HTML. This works in string mode but not with `RETURN_DOM` or `RETURN_DOM_FRAGMENT`, allowing XSS via template-evaluating frameworks like Vue 2.
## Technical Details
DOMPurify strips template expressions in two passes:
1. **Per-node** — each text node is checked during the tree walk ([`purify.ts:1179-1191`](https://github.com/cure53/DOMP
Red Hat
DOMPurify: Vue 2: DOMPurify: Cross-site scripting due to incomplete sanitization of template expressions
vendor_redhat·2026-04-23·CVSS 6.8
CVE-2026-41239 [MEDIUM] CWE-1289 DOMPurify: Vue 2: DOMPurify: Cross-site scripting due to incomplete sanitization of template expressions
DOMPurify: Vue 2: DOMPurify: Cross-site scripting due to incomplete sanitization of template expressions
A flaw was found in DOMPurify. A remote attacker could exploit this cross-site scripting (XSS) vulnerability when DOMPurify is configured to return a Document Object Model (DOM) or DOM fragment. The SAFE_FOR_TEMPLATES feature, intended to strip template expressions like {{...}}, fails in these modes, allowing malicious content to bypass sanitization. This can lead to arbitrary code execution or information disclosure in applications utilizing template-evaluating frameworks such as Vue 2.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability
No detection rules found.
No public exploits indexed.
2026-04-23
Published