CVE-2026-41240
Fixed in a distro release EPSS <1%CVSS 6.0
DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Versions prior to 3.4.0 have an inconsistency between FORBID_TAGS and FORBID_ATTR handling when function-based ADD_TAGS is used. Commit c361baa added an early exit for FORBID_ATTR at line 1214. The same fix was not applied to FORBID_TAGS. At line 1118-1123, when EXTRA_ELEMENT_HANDLING.tagCheck returns true, the short-circuit evaluation skips the FORBID_TAGS check entirely. This allows forbidden elements to survive sanitization with their attributes intact. Version 3.4.0 patches the issue.
Products: cure53 dompurify
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| npm | dompurify | 3.4.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | airflow-2 | no fix |
| Chainguard | airflow-core-2 | no fix |
| Chainguard | gitlab-rails-ce-18.1 | no fix |
| Chainguard | gitlab-rails-ce-18.10 | no fix |
| Chainguard | gitlab-rails-ce-18.11 | 18.11.13-r0 |
| Chainguard | gitlab-rails-ce-18.5 | no fix |
| Chainguard | gitlab-rails-ce-18.6 | no fix |
| Chainguard | gitlab-rails-ce-18.7 | no fix |
| Chainguard | gitlab-rails-ce-18.8 | no fix |
| Chainguard | gitlab-rails-ce-18.9 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.1 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.10 | 18.10.8-r8 |
| Chainguard | gitlab-rails-ce-fips-18.11 | 18.11.12-r2 |
| Chainguard | gitlab-rails-ce-fips-18.5 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.6 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.7 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.8 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.9 | 18.9.8-r8 |
| Chainguard | langfuse-fips-3 | 3.164.0-r6 |
| Chainguard | langfuse-fips-3-worker | 3.164.0-r6 |
| Chainguard | nextcloud-server-31 | no fix |
| Chainguard | nextcloud-server-33 | 33.0.6-r0 |
| Chainguard | opensearch-dashboards-3 | 3.6.0-r3 |
| Chainguard | opensearch-dashboards-3-fips | 3.6.0-r4 |
| Chainguard | wazuh-dashboard-alerting-dashboards-plugin | 4.14.4-r3 |
| Chainguard | wazuh-dashboard-anomaly-detection-dashboards-plugin | 4.14.4-r3 |
| Chainguard | wazuh-dashboard-dashboards-maps | 4.14.4-r3 |
| Chainguard | wazuh-dashboard-dashboards-notifications | 4.14.4-r3 |
| Chainguard | wazuh-dashboard-dashboards-reporting | 4.14.4-r3 |
| Chainguard | wazuh-dashboard-dashboards-visualizations | 4.14.4-r3 |
| Chainguard | wazuh-dashboard-index-management-dashboards-plugin | 4.14.4-r3 |
| Chainguard | wazuh-dashboard-plugins | 4.14.4-r3 |
| Chainguard | wazuh-dashboard-plugins-fips | 4.14.4-r2 |
| Debian 12 | node-dompurify | no fix |
| Debian 13 | node-dompurify | no fix |
| Debian 14 | node-dompurify | 3.4.1+dfsg-1 |
| Red Hat ansible automation platform 2.6 | automation-controller | 0:4.7.13-2.el9ap |
| Red Hat ansible automation platform 2.6 | automation-controller-cli | 0:4.7.13-2.el9ap |
| Red Hat ansible automation platform 2.6 | automation-controller-server | 0:4.7.13-2.el9ap |
| Red Hat ansible automation platform 2.6 | automation-controller-ui | 0:4.7.13-2.el9ap |
| Red Hat ansible automation platform 2.6 | automation-controller-venv-tower | 0:4.7.13-2.el9ap |
| Red Hat ansible automation platform 2.6 | automation-platform-ui | 0:2.6.10-1.el9ap |
| Red Hat ansible automation platform 2.6 | python3.12-pyjwt | 0:2.13.0-1.el9ap |
| Red Hat ansible automation platform 2.6 | python3.12-pyjwt+crypto | 0:2.13.0-1.el9ap |
| Red Hat ansible automation platform 2.6 | python3.12-pysequoia | 0:0.1.34-1.el9ap |
| Red Hat ansible automation platform 2.6 | python3.12-pysequoia-debuginfo | 0:0.1.34-1.el9ap |
| Red Hat ansible automation platform 2.6 | python3.12-pysequoia-debugsource | 0:0.1.34-1.el9ap |
| Red Hat ansible automation platform 2.6 | python3.12-urllib3 | 0:2.7.0-1.el9ap |
| Red Hat ansible automation platform developer 2.6 | automation-controller | 0:4.7.13-2.el9ap |
| Red Hat ansible automation platform developer 2.6 | automation-controller-cli | 0:4.7.13-2.el9ap |
| Red Hat ansible automation platform developer 2.6 | python3.12-urllib3 | 0:2.7.0-1.el9ap |
| Ubuntu 22.04 LTS | node-dompurify | no fix |
| Ubuntu 24.04 LTS | node-dompurify | no fix |
| Ubuntu 25.10 | node-dompurify | no fix |
| Ubuntu 26.04 LTS | node-dompurify | no fix |
| Ubuntu 26.10 | node-dompurify | no fix |
| Wolfi | nextcloud-server-33 | 33.0.6-r0 |
| Wolfi | opensearch-dashboards-3 | 3.6.0-r3 |
| openSUSE Tumbleweed | argocd-cli | 3.4.3-1.1 |