CVE-2026-0540
Fixed in a distro release EPSS <1%CVSS 6.1
DOMPurify 3.1.3 through 3.3.1 and 2.5.3 through 2.5.8, fixed in commit 2726c74, contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting five missing rawtext elements (noscript, xmp, noembed, noframes, iframe) in the SAFE_FOR_XML regex. Attackers can include payloads like </noscript><img src=x onerror=alert(1)> in attribute values to execute JavaScript when sanitized output is placed inside these unprotected rawtext contexts.
Products: cure53 dompurify
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| npm | dompurify | 3.3.2 |
| npm | dompurify | 2.5.9 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | airflow-2 | no fix |
| Chainguard | airflow-core-2 | no fix |
| Chainguard | gitlab-rails-ce-18.1 | no fix |
| Chainguard | gitlab-rails-ce-18.5 | no fix |
| Chainguard | gitlab-rails-ce-18.6 | no fix |
| Chainguard | gitlab-rails-ce-18.7 | no fix |
| Chainguard | gitlab-rails-ce-18.8 | no fix |
| Chainguard | gitlab-rails-ce-18.9 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.1 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.5 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.6 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.7 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.8 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.9 | 18.9.8-r8 |
| Chainguard | kibana-8.19 | 8.19.13-r0 |
| Chainguard | kibana-8.19-bitnami | 8.19.13-r0 |
| Chainguard | kibana-8.19-iamguarded | 8.19.13-r0 |
| Chainguard | kibana-9.1 | 9.1.10-r7 |
| Chainguard | kibana-9.1-iamguarded | 9.1.10-r7 |
| Chainguard | kibana-9.2 | 9.2.6-r2 |
| Chainguard | kibana-9.2-iamguarded | 9.2.6-r2 |
| Chainguard | kibana-9.3 | 9.3.1-r1 |
| Chainguard | kibana-9.3-iamguarded | 9.3.1-r1 |
| Chainguard | langfuse-2 | 2.95.12-r13 |
| Chainguard | langfuse-2-worker | 2.95.12-r13 |
| Chainguard | langfuse-3 | 3.160.0-r1 |
| Chainguard | langfuse-3-worker | 3.160.0-r1 |
| Chainguard | langfuse-fips-2 | 2.95.12-r16 |
| Chainguard | langfuse-fips-2-worker | 2.95.12-r16 |
| Chainguard | langfuse-fips-3 | 3.160.0-r1 |
| Chainguard | langfuse-fips-3-worker | 3.160.0-r1 |
| Chainguard | librechat | 0.8.3-r0 |
| Chainguard | nextcloud-server-31 | no fix |
| Chainguard | opensearch-dashboards-2 | 2.19.5-r3 |
| Chainguard | opensearch-dashboards-2-alerting-dashboards-plugin | 2.19.4-r14 |
| Chainguard | opensearch-dashboards-2-anomaly-detection-dashboards-plugin | 2.19.4-r14 |
| Chainguard | opensearch-dashboards-2-dashboards-maps | 2.19.4-r14 |
| Chainguard | opensearch-dashboards-2-dashboards-notifications | 2.19.4-r14 |
| Chainguard | opensearch-dashboards-2-dashboards-observability | 2.19.4-r14 |
| Chainguard | opensearch-dashboards-2-dashboards-query-workbench | 2.19.4-r14 |
| Chainguard | opensearch-dashboards-2-dashboards-reporting | 2.19.5-r3 |
| Chainguard | opensearch-dashboards-2-dashboards-search-relevance | 2.19.4-r14 |
| Chainguard | opensearch-dashboards-2-dashboards-visualizations | 2.19.4-r14 |
| Chainguard | opensearch-dashboards-2-fips | 2.19.5-r1 |
| Chainguard | opensearch-dashboards-2-fips-alerting-dashboards-plugin | 2.19.4-r14 |
| Chainguard | opensearch-dashboards-2-fips-anomaly-detection-dashboards-plugin | 2.19.4-r14 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-maps | 2.19.4-r14 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-notifications | 2.19.4-r14 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-observability | 2.19.4-r14 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-query-workbench | 2.19.4-r14 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-reporting | 2.19.5-r1 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-search-relevance | 2.19.4-r14 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-visualizations | 2.19.4-r14 |
| Chainguard | opensearch-dashboards-2-fips-index-management-dashboards-plugin | 2.19.4-r14 |
| Chainguard | opensearch-dashboards-2-fips-ml-commons-dashboards | 2.19.4-r14 |
| Chainguard | opensearch-dashboards-2-fips-security-analytics-dashboards-plugin | 2.19.4-r14 |
| Chainguard | opensearch-dashboards-2-fips-security-dashboards-plugin | 2.19.4-r14 |
| Chainguard | opensearch-dashboards-2-index-management-dashboards-plugin | 2.19.4-r14 |
| Chainguard | opensearch-dashboards-2-ml-commons-dashboards | 2.19.4-r14 |
| Chainguard | opensearch-dashboards-2-security-analytics-dashboards-plugin | 2.19.4-r14 |
| Chainguard | opensearch-dashboards-2-security-dashboards-plugin | 2.19.4-r14 |
| Chainguard | opensearch-dashboards-3 | 3.5.0-r6 |
| Chainguard | opensearch-dashboards-3-alerting-dashboards-plugin | 3.5.0-r6 |
| Chainguard | opensearch-dashboards-3-anomaly-detection-dashboards-plugin | 3.5.0-r6 |
| Chainguard | opensearch-dashboards-3-dashboards-maps | 3.5.0-r6 |
| Chainguard | opensearch-dashboards-3-dashboards-notifications | 3.5.0-r6 |
| Chainguard | opensearch-dashboards-3-dashboards-observability | 3.5.0-r6 |
| Chainguard | opensearch-dashboards-3-dashboards-query-workbench | 3.5.0-r6 |
| Chainguard | opensearch-dashboards-3-dashboards-reporting | 3.5.0-r6 |
| Chainguard | opensearch-dashboards-3-dashboards-search-relevance | 3.5.0-r6 |
| Chainguard | opensearch-dashboards-3-fips | 3.5.0-r6 |
| Chainguard | opensearch-dashboards-3-fips-alerting-dashboards-plugin | 3.5.0-r4 |
| Chainguard | opensearch-dashboards-3-fips-anomaly-detection-dashboards-plugin | 3.5.0-r4 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-maps | 3.5.0-r4 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-notifications | 3.5.0-r4 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-observability | 3.5.0-r4 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-observability | 3.5.0-r6 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-query-workbench | 3.5.0-r4 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-reporting | 3.5.0-r6 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-search-relevance | 3.5.0-r4 |
| Chainguard | opensearch-dashboards-3-fips-index-management-dashboards-plugin | 3.5.0-r4 |
| Chainguard | opensearch-dashboards-3-fips-ml-commons-dashboards | 3.5.0-r4 |
| Chainguard | opensearch-dashboards-3-fips-security-analytics-dashboards-plugin | 3.5.0-r4 |
| Chainguard | opensearch-dashboards-3-fips-security-dashboards-plugin | 3.5.0-r4 |
| Chainguard | opensearch-dashboards-3-index-management-dashboards-plugin | 3.5.0-r6 |
| Chainguard | opensearch-dashboards-3-ml-commons-dashboards | 3.5.0-r6 |
| Chainguard | opensearch-dashboards-3-security-analytics-dashboards-plugin | 3.5.0-r6 |
| Chainguard | opensearch-dashboards-3-security-dashboards-plugin | 3.5.0-r6 |
| Chainguard | wazuh-dashboard-plugins | 4.14.4-r1 |
| Debian 12 | node-dompurify | no fix |
| Debian 13 | node-dompurify | no fix |
| Debian 14 | node-dompurify | 3.3.2+dfsg-1 |
| Ubuntu 22.04 LTS | node-dompurify | no fix |
| Ubuntu 24.04 LTS | node-dompurify | no fix |
| Ubuntu 25.10 | node-dompurify | no fix |
| Ubuntu 26.04 LTS | node-dompurify | no fix |
| Ubuntu 26.10 | node-dompurify | no fix |
| Wolfi | langfuse-3 | 3.160.0-r1 |
| Wolfi | langfuse-3-worker | 3.160.0-r1 |
| Wolfi | opensearch-dashboards-3 | 3.5.0-r6 |
| Wolfi | opensearch-dashboards-3-alerting-dashboards-plugin | 3.5.0-r6 |
| Wolfi | opensearch-dashboards-3-anomaly-detection-dashboards-plugin | 3.5.0-r6 |
| Wolfi | opensearch-dashboards-3-dashboards-maps | 3.5.0-r6 |
| Wolfi | opensearch-dashboards-3-dashboards-notifications | 3.5.0-r6 |
| Wolfi | opensearch-dashboards-3-dashboards-observability | 3.5.0-r6 |
| Wolfi | opensearch-dashboards-3-dashboards-query-workbench | 3.5.0-r6 |
| Wolfi | opensearch-dashboards-3-dashboards-reporting | 3.5.0-r6 |
| Wolfi | opensearch-dashboards-3-dashboards-search-relevance | 3.5.0-r6 |
| Wolfi | opensearch-dashboards-3-index-management-dashboards-plugin | 3.5.0-r6 |
| Wolfi | opensearch-dashboards-3-ml-commons-dashboards | 3.5.0-r6 |
| Wolfi | opensearch-dashboards-3-security-analytics-dashboards-plugin | 3.5.0-r6 |
| Wolfi | opensearch-dashboards-3-security-dashboards-plugin | 3.5.0-r6 |
| openSUSE Tumbleweed | cacti | 1.2.30+git306.82d5aef5-1.1 |