Vulnerability · Published Apr 23, 2026 · Assigned by GitHub_M

CVE-2026-41240DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix)

Medium 6.0

In plain English

A medium-severity cross-site scripting in DOMPurify from cure53. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.0Medium

Exploit odds (30 days)0.3%top 75.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Versions prior to 3.4.0 have an inconsistency between FORBID_TAGS and FORBID_ATTR handling when function-based ADD_TAGS is used. Commit c361baa added an early exit for FORBID_ATTR at line 1214. The same fix was not applied to FORBID_TAGS. At line 1118-1123, when EXTRA_ELEMENT_HANDLING.tagCheck returns true, the short-circuit evaluation skips the FORBID_TAGS check entirely. This allows forbidden elements to survive sanitization with their attributes intact. Version 3.4.0 patches the issue.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	node-dompurify	no fix listed	DEBIAN-CVE-2026-41240
Debian:13	node-dompurify	no fix listed	DEBIAN-CVE-2026-41240
Debian:14	node-dompurify	3.4.1+dfsg-1	DEBIAN-CVE-2026-41240
Ubuntu:22.04:LTS	node-dompurify	no fix listed	UBUNTU-CVE-2026-41240
Ubuntu:24.04:LTS	node-dompurify	no fix listed	UBUNTU-CVE-2026-41240
Ubuntu:25.10	node-dompurify	no fix listed	UBUNTU-CVE-2026-41240
Ubuntu:26.04:LTS	node-dompurify	no fix listed	UBUNTU-CVE-2026-41240
Ubuntu:26.10	node-dompurify	no fix listed	UBUNTU-CVE-2026-41240
npm	dompurify	3.4.0	GHSA-h7mw-gpvr-xq4m

Affected products (as reported)

Vendor	Product	Versions
cure53	DOMPurify	< 3.4.0

Weakness: CWE-183, CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

References

https://github.com/cure53/DOMPurify/security/advisories/GHSA-h7mw-gpvr-xq4m x_refsource_CONFIRM
https://github.com/cure53/DOMPurify/commit/c361baa18dbdcb3344a41110f4c48ad85bf48f80 x_refsource_MISC
https://github.com/cure53/DOMPurify/releases/tag/3.4.0 x_refsource_MISC