CVE-2026-41238: DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING Fallback

CVE-2026-41238 · Severity: medium · CVSS 6.9 · Published 2026-04-23

DOMPurify is a popular JavaScript library used by web applications to sanitize user-supplied HTML and prevent cross-site scripting (XSS) attacks. When an application uses DOMPurify with default settings and another prototype pollution vulnerability exists in the same JavaScript context, an attacker can bypass the XSS protections by poisoning object prototypes, allowing malicious HTML with event handlers to pass through sanitization. This could enable account takeover or data theft if the sanitized content is displayed to users.

Technologies: dompurify (npm). Vendors: npm.

Quick answers

Is CVE-2026-41238 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-41238 being exploited in the wild.
How severe is CVE-2026-41238?
Medium severity, with a CVSS score of 6.9, published 23 April 2026.
Which products and versions are affected?
dompurify (npm) >= 3.0.1, < 3.4.0, SEMVER:introduced=3.0.1,fixed=3.4.0.
Is there a fix for CVE-2026-41238?
Yes. dompurify (npm): upgrade to 3.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41238 attacked?
It is attacked over the network.
Am I affected by CVE-2026-41238?
Check whether you run dompurify (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • dompurify (npm): upgrade to 3.4.0 or later
    npm install dompurify@3.4.0

Technical details

This vulnerability exploits a prototype pollution chain in DOMPurify versions 3.0.1–3.3.3. At line 590 of purify.js, when CUSTOM_ELEMENT_HANDLING is not provided in the config, the code assigns a plain object `{}` which inherits from Object.prototype. An attacker with a separate prototype pollution primitive (e.g., via vulnerable lodash or jQuery.extend in the same execution context) can pollute Object.prototype.tagNameCheck and Object.prototype.attributeNameCheck with permissive regex values (e.g., `/.*/`). The sanitizer then resolves these properties via the prototype chain instead of using its default restrictions, allowing custom elements and event handler attributes through. The attack requires both a prototype pollution gadget and that the victim view the injected content, but prototype pollution vulnerabilities are widespread in JavaScript libraries. Fix: use Object.create(null) instead of `{}` to prevent prototype chain inheritance, or explicitly provide CUSTOM_ELEMENT_HANDLING in the config.

Affected products

  • cure53 DOMPurify 3.0.1 through 3.3.3

Identifiers

  • CVE-2026-41238
  • GHSA-v9jr-rg53-9pgp

Timeline

  • 2026-04-20: disclosed
  • 2026-04-20: patched: Fixed in version 3.4.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.