Bug 2461160 (CVE-2026-41238)

Summary:	CVE-2026-41238 DOMPurify: DOMPurify: Cross-Site Scripting bypass via prototype pollution
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aazores, abarbaro, abrianik, akostadi, alcohan, alizardo, amasferr, amctagga, anjoseph, anpicker, aoconnor, bniver, bparees, cdrage, chfoley, cmah, dkeler, dmayorov, dschmidt, eaguilar, ebaron, erezende, ewittman, fdeutsch, flucifre, ggrzybek, gmeno, gparvin, groman, hasun, janstey, jbalunas, jchui, jfula, jhe, jkoehler, jlanda, jlledo, jolong, jowilson, jprabhak, jraez, jwong, kaycoth, kbempah, kshier, ktsao, lchilton, lphiri, manissin, mbarnett, mbenjamin, mhackett, nboldt, nipatil, nyancey, oaljalju, omaciel, ometelka, oramraz, pahickey, pantinor, parichar, pjindal, psrna, ptisnovs, rgodfrey, rhaigner, rhel-process-autobot, rkubis, rushinde, sdawley, sfeifer, simaishi, smcdonal, smullick, solenoci, sostapov, stcannon, stirabos, suppawar, swoodman, syedriko, tasato, teagle, thason, tsedmik, ttakamiy, vereddy, watson-tool-maintainers, wtam, xdharmai, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in DOMPurify, a software library used to clean potentially malicious code from web content, preventing Cross-Site Scripting (XSS) attacks. A remote attacker could exploit a vulnerability related to 'prototype pollution' to bypass DOMPurify's security checks. This allows the attacker to inject harmful code, such as event handlers, into web pages. If successfully exploited, this could lead to the execution of arbitrary code in a user's web browser.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-04-23 16:28:00 UTC

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Versions 3.0.1 through 3.3.3 are vulnerable to a prototype pollution-based XSS bypass. When an application uses `DOMPurify.sanitize()` with the default configuration (no `CUSTOM_ELEMENT_HANDLING` option), a prior prototype pollution gadget can inject permissive `tagNameCheck` and `attributeNameCheck` regex values into `Object.prototype`, causing DOMPurify to allow arbitrary custom elements with arbitrary attributes — including event handlers — through sanitization. Version 3.4.0 fixes the issue.