Bug 2461147 (CVE-2026-41240) - CVE-2026-41240 DOMPurify: DOMPurify: Cross-Site Scripting (XSS) via inconsistent tag sanitization
Summary: CVE-2026-41240 DOMPurify: DOMPurify: Cross-Site Scripting (XSS) via inconsist...
Keywords:
Status: NEW
Alias: CVE-2026-41240
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2463430 2463429 2463431 2463432
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-04-23 16:05 UTC by OSIDB Bzimport
Modified: 2026-07-02 00:05 UTC (History)
98 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2026:22619 0 None None None 2026-06-02 17:41:33 UTC
Red Hat Product Errata RHSA-2026:28010 0 None None None 2026-06-22 17:15:38 UTC
Red Hat Product Errata RHSA-2026:34160 0 None None None 2026-07-01 11:02:37 UTC
Red Hat Product Errata RHSA-2026:34608 0 None None None 2026-07-02 00:05:11 UTC

Description OSIDB Bzimport 2026-04-23 16:05:05 UTC 
DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Versions prior to 3.4.0 have an inconsistency between FORBID_TAGS and FORBID_ATTR handling when function-based ADD_TAGS is used. Commit c361baa added an early exit for FORBID_ATTR at line 1214. The same fix was not applied to FORBID_TAGS. At line 1118-1123, when EXTRA_ELEMENT_HANDLING.tagCheck returns true, the short-circuit evaluation skips the FORBID_TAGS check entirely. This allows forbidden elements to survive sanitization with their attributes intact. Version 3.4.0 patches the issue.
Comment 1 errata-xmlrpc 2026-06-02 17:41:27 UTC 
This issue has been addressed in the following products:

  Red Hat Data Grid 8.6.1

Via RHSA-2026:22619 https://access.redhat.com/errata/RHSA-2026:22619
Comment 2 errata-xmlrpc 2026-06-22 17:15:32 UTC 
This issue has been addressed in the following products:

  Cryostat 4 on RHEL 9

Via RHSA-2026:28010 https://access.redhat.com/errata/RHSA-2026:28010
Comment 3 errata-xmlrpc 2026-07-01 11:02:31 UTC 
This issue has been addressed in the following products:

  Red Hat Ansible Automation Platform 2.6 for RHEL 9

Via RHSA-2026:34160 https://access.redhat.com/errata/RHSA-2026:34160
Comment 4 errata-xmlrpc 2026-07-02 00:05:05 UTC 
This issue has been addressed in the following products:

  Streams for Apache Kafka 2.9.4

Via RHSA-2026:34608 https://access.redhat.com/errata/RHSA-2026:34608
Note You need to log in before you can comment on or make changes to this bug.