CVE-2026-41239 — Cross-site Scripting in Dompurify

CWE-79 — Cross-site ScriptingCWE-1289 — Improper Validation of Unsafe Equivalence in Input4 documents4 sources
Severity
6.8MEDIUMNVD
EPSS
0.0%
top 85.18%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
45
Cure53 Dompurify3scale-amp2 System-rhel73scale-amp2 System-rhel8+42 more
Timeline
PublishedApr 23

Description

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Starting in version 1.0.10 and prior to version 3.4.0, `SAFE_FOR_TEMPLATES` strips `{{...}}` expressions from untrusted HTML. This works in string mode but not with `RETURN_DOM` or `RETURN_DOM_FRAGMENT`, allowing XSS via template-evaluating frameworks like Vue 2. Version 3.4.0 patches the issue.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:NExploitability: 1.6 | Impact: 5.2

Affected Packages47 packages

▶npmcure53/dompurify1.0.10 — 3.4.0
▶CVEListV5cure53/dompurify>= 1.0.10, < 3.4.0
▶Red Hatgrafana/grafana

🔴Vulnerability Details

2
VulDB
cure53 DOMPurify up to 3.3.x cross site scripting↗2026-04-23
▶
GHSA
DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode↗2026-04-22
▶

📋Vendor Advisories

1
Red Hat
DOMPurify: Vue 2: DOMPurify: Cross-site scripting due to incomplete sanitization of template expressions↗2026-04-23
▶