CVE-2026-41240: DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix)

CVE-2026-41240 · Severity: medium · CVSS 6.1 · Published 2026-04-23

DOMPurify is a widely-used JavaScript HTML sanitization library that removes potentially dangerous content from user-supplied HTML. A configuration inconsistency allows attackers to bypass tag blocking rules when using function-based tag allowlists, potentially injecting malicious iframe, form, and other elements with external URLs. This could enable credential theft, data exfiltration, and XSS attacks in applications that rely on FORBID_TAGS to block dangerous elements.

Technologies: Cure53 DOMPurify, dompurify (npm). Vendors: Cure53, npm.

Quick answers

Is CVE-2026-41240 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-41240 being exploited in the wild.
How severe is CVE-2026-41240?
Medium severity, with a CVSS score of 6.1, published 23 April 2026.
Which products and versions are affected?
dompurify (npm) < 3.4.0, SEMVER:introduced=0,fixed=3.4.0.
Is there a fix for CVE-2026-41240?
Yes. dompurify (npm): upgrade to 3.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41240 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-41240?
Check whether you run Cure53 DOMPurify or dompurify (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • dompurify (npm): upgrade to 3.4.0 or later
    npm install dompurify@3.4.0

Technical details

This vulnerability is a logic bypass (CWE-183) in DOMPurify's tag sanitization flow. The root cause is asymmetric handling of FORBID_TAGS and ADD_TAGS: a prior fix (commit c361baa) added an early exit for FORBID_ATTR before checking ADD_ATTR, but the same logic was not applied to tags. When EXTRA_ELEMENT_HANDLING.tagCheck is a function that returns true, short-circuit evaluation in the conditional at lines 1118–1123 skips the FORBID_TAGS check entirely, allowing forbidden tags like iframe, form, object, and embed to pass through with their attributes intact. The vulnerability requires a function-based ADD_TAGS predicate in the configuration (uncommon but legitimate usage). An attacker who controls the sanitizer configuration and input HTML can inject dangerous elements; impact depends on the application context but includes XSS, phishing (form injection), and data theft (iframe with external action/src).

Affected products

  • Cure53 DOMPurify <= 3.2.6

Identifiers

  • CVE-2026-41240
  • GHSA-h7mw-gpvr-xq4m

Timeline

  • 2026-04-22: disclosed: Advisory published
  • 2026-04-20: patched: Fix released in version 3.4.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.