DOMPurify XSS via Missing Rawtext Elements in SAFE_FOR_XML
Published Mar 3, 2026
5.3
MEDIUMCVSS 4.0
EPSS 0.35%
Description
DOMPurify 3.1.3 through 3.3.1 and 2.5.3 through 2.5.8, fixed in commit 2726c74, contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting five missing rawtext elements (noscript, xmp, noembed, noframes, iframe) in the SAFE_FOR_XML regex. Attackers can include payloads like </noscript><img src=x onerror=alert(1)> in attribute values to execute JavaScript when sanitized output is placed inside these unprotected rawtext contexts.
Affected products
-
- Version 2.5.3StatusaffectedConstraints<=2.5.8
- Version 3.1.3StatusaffectedConstraints<=3.3.1
- Version
No data.
Cryostat 4
io.cryostat-cryostat
Fix deferred
Migration Toolkit for Virtualization
migration-toolkit-virtualization/mtv-console-plugin-rhel9
Fix deferred
Migration Toolkit for Virtualization
mtv-candidate/mtv-console-plugin-rhel9
Fix deferred
Multicluster Engine for Kubernetes
multicluster-engine/console-mce-rhel9
Fix deferred
Network Observability Operator
network-observability/network-observability-console-plugin-compat-rhel9
Fix deferred
Node HealthCheck Operator
workload-availability/node-healthcheck-must-gather-rhel9
Fix deferred
Node HealthCheck Operator
workload-availability/node-healthcheck-operator-bundle
Fix deferred
Node HealthCheck Operator
workload-availability/node-healthcheck-rhel9-operator
Fix deferred
Node HealthCheck Operator
workload-availability/node-remediation-console-rhel9
Fix deferred
OpenShift Pipelines
openshift-pipelines/pipelines-hub-api-rhel8
Fix deferred
OpenShift Pipelines
openshift-pipelines/pipelines-hub-db-migration-rhel8
Fix deferred
OpenShift Pipelines
openshift-pipelines/pipelines-hub-ui-rhel8
Fix deferred
Red Hat 3scale API Management Platform 2
3scale-amp2/system-rhel7
Fix deferred
Red Hat 3scale API Management Platform 2
3scale-amp2/system-rhel8
Fix deferred
Red Hat 3scale API Management Platform 2
3scale-amp2/system-rhel9
Fix deferred
Red Hat 3scale API Management Platform 2
3scale-amp20/system
Fix deferred
Red Hat 3scale API Management Platform 2
3scale-amp21/system
Fix deferred
Red Hat 3scale API Management Platform 2
3scale-amp22/system
Fix deferred
Red Hat 3scale API Management Platform 2
3scale-amp24/system
Fix deferred
Red Hat 3scale API Management Platform 2
3scale-amp25/system
Fix deferred
Red Hat 3scale API Management Platform 2
3scale-amp26/system
Fix deferred
Red Hat Advanced Cluster Management for Kubernetes 2
rhacm2/console-rhel9
Fix deferred
Red Hat Advanced Cluster Security 4
advanced-cluster-security/rhacs-main-rhel8
Fix deferred
Red Hat Ansible Automation Platform 2
ansible-automation-platform-26/gateway-rhel9
Fix deferred
Red Hat Ansible Automation Platform 2
automation-controller
Fix deferred
Red Hat Ansible Automation Platform 2
automation-eda-controller
Fix deferred
Red Hat Ansible Automation Platform 2
automation-gateway
Fix deferred
Red Hat Ansible Automation Platform 2
automation-platform-ui
Fix deferred
Red Hat Enterprise Linux 10
grafana
Fix deferred
Red Hat Enterprise Linux 8
grafana
Fix deferred
Red Hat Enterprise Linux 9
grafana
Fix deferred
Red Hat OpenShift AI (RHOAI)
rhoai/odh-dashboard-rhel9
Fix deferred
Red Hat OpenShift AI (RHOAI)
rhoai/odh-data-science-pipelines-argo-argoexec-rhel8
Fix deferred
Red Hat OpenShift AI (RHOAI)
rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel8
Fix deferred
Red Hat OpenShift AI (RHOAI)
rhoai/odh-mod-arch-gen-ai-rhel9
Fix deferred
Red Hat OpenShift AI (RHOAI)
rhoai/odh-mod-arch-model-registry-rhel9
Fix deferred
Red Hat OpenShift AI (RHOAI)
rhoai/odh-model-registry-rhel8
Fix deferred
Red Hat OpenShift Container Platform 4
openshift4/ose-console
Fix deferred
Red Hat OpenShift Container Platform 4
openshift4/ose-console-rhel9
Fix deferred
Red Hat OpenShift Container Platform 4
openshift4/ose-monitoring-plugin-rhel9
Fix deferred
Red Hat OpenShift GitOps
openshift-gitops-1/argocd-rhel8
Fix deferred
Red Hat OpenShift GitOps
openshift-gitops-1/argocd-rhel9
Fix deferred
Red Hat OpenShift GitOps
openshift-gitops-1/console-plugin-rhel8
Fix deferred
Red Hat OpenShift Virtualization 4
container-native-virtualization/kubevirt-console-plugin
Fix deferred
Red Hat OpenShift Virtualization 4
container-native-virtualization/kubevirt-console-plugin-rhel9
Fix deferred
Red Hat Openshift Data Foundation 4
odf4/ocs-client-console-rhel9
Fix deferred
Red Hat Openshift Data Foundation 4
odf4/odf-console-rhel9
Fix deferred
Red Hat Openshift Data Foundation 4
odf4/odf-multicluster-console-rhel9
Fix deferred
Red Hat Process Automation 7
org.kie-process-migration-service
Fix deferred
Red Hat build of Apache Camel - HawtIO 4
io.hawt-project
Fix deferred
Red Hat build of Apicurio Registry 2
io.apicurio-apicurio-registry
Fix deferred
Self-service automation portal 2
ansible-automation-platform/automation-portal
Fix deferred
streams for Apache Kafka 2
com.github.streamshub-console
Fix deferred
streams for Apache Kafka 3
com.github.streamshub-console
Fix deferred
| Product | Package | State | Advisory |
|---|---|---|---|
| Cryostat 4 | io.cryostat-cryostat | Fix deferred | n/a |
| Migration Toolkit for Virtualization | migration-toolkit-virtualization/mtv-console-plugin-rhel9 | Fix deferred | n/a |
| Migration Toolkit for Virtualization | mtv-candidate/mtv-console-plugin-rhel9 | Fix deferred | n/a |
| Multicluster Engine for Kubernetes | multicluster-engine/console-mce-rhel9 | Fix deferred | n/a |
| Network Observability Operator | network-observability/network-observability-console-plugin-compat-rhel9 | Fix deferred | n/a |
| Node HealthCheck Operator | workload-availability/node-healthcheck-must-gather-rhel9 | Fix deferred | n/a |
| Node HealthCheck Operator | workload-availability/node-healthcheck-operator-bundle | Fix deferred | n/a |
| Node HealthCheck Operator | workload-availability/node-healthcheck-rhel9-operator | Fix deferred | n/a |
| Node HealthCheck Operator | workload-availability/node-remediation-console-rhel9 | Fix deferred | n/a |
| OpenShift Pipelines | openshift-pipelines/pipelines-hub-api-rhel8 | Fix deferred | n/a |
| OpenShift Pipelines | openshift-pipelines/pipelines-hub-db-migration-rhel8 | Fix deferred | n/a |
| OpenShift Pipelines | openshift-pipelines/pipelines-hub-ui-rhel8 | Fix deferred | n/a |
| Red Hat 3scale API Management Platform 2 | 3scale-amp2/system-rhel7 | Fix deferred | n/a |
| Red Hat 3scale API Management Platform 2 | 3scale-amp2/system-rhel8 | Fix deferred | n/a |
| Red Hat 3scale API Management Platform 2 | 3scale-amp2/system-rhel9 | Fix deferred | n/a |
| Red Hat 3scale API Management Platform 2 | 3scale-amp20/system | Fix deferred | n/a |
| Red Hat 3scale API Management Platform 2 | 3scale-amp21/system | Fix deferred | n/a |
| Red Hat 3scale API Management Platform 2 | 3scale-amp22/system | Fix deferred | n/a |
| Red Hat 3scale API Management Platform 2 | 3scale-amp24/system | Fix deferred | n/a |
| Red Hat 3scale API Management Platform 2 | 3scale-amp25/system | Fix deferred | n/a |
| Red Hat 3scale API Management Platform 2 | 3scale-amp26/system | Fix deferred | n/a |
| Red Hat Advanced Cluster Management for Kubernetes 2 | rhacm2/console-rhel9 | Fix deferred | n/a |
| Red Hat Advanced Cluster Security 4 | advanced-cluster-security/rhacs-main-rhel8 | Fix deferred | n/a |
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-26/gateway-rhel9 | Fix deferred | n/a |
| Red Hat Ansible Automation Platform 2 | automation-controller | Fix deferred | n/a |
| Red Hat Ansible Automation Platform 2 | automation-eda-controller | Fix deferred | n/a |
| Red Hat Ansible Automation Platform 2 | automation-gateway | Fix deferred | n/a |
| Red Hat Ansible Automation Platform 2 | automation-platform-ui | Fix deferred | n/a |
| Red Hat Enterprise Linux 10 | grafana | Fix deferred | n/a |
| Red Hat Enterprise Linux 8 | grafana | Fix deferred | n/a |
| Red Hat Enterprise Linux 9 | grafana | Fix deferred | n/a |
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-dashboard-rhel9 | Fix deferred | n/a |
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-data-science-pipelines-argo-argoexec-rhel8 | Fix deferred | n/a |
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel8 | Fix deferred | n/a |
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-mod-arch-gen-ai-rhel9 | Fix deferred | n/a |
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-mod-arch-model-registry-rhel9 | Fix deferred | n/a |
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-model-registry-rhel8 | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-console | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-console-rhel9 | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-monitoring-plugin-rhel9 | Fix deferred | n/a |
| Red Hat OpenShift GitOps | openshift-gitops-1/argocd-rhel8 | Fix deferred | n/a |
| Red Hat OpenShift GitOps | openshift-gitops-1/argocd-rhel9 | Fix deferred | n/a |
| Red Hat OpenShift GitOps | openshift-gitops-1/console-plugin-rhel8 | Fix deferred | n/a |
| Red Hat OpenShift Virtualization 4 | container-native-virtualization/kubevirt-console-plugin | Fix deferred | n/a |
| Red Hat OpenShift Virtualization 4 | container-native-virtualization/kubevirt-console-plugin-rhel9 | Fix deferred | n/a |
| Red Hat Openshift Data Foundation 4 | odf4/ocs-client-console-rhel9 | Fix deferred | n/a |
| Red Hat Openshift Data Foundation 4 | odf4/odf-console-rhel9 | Fix deferred | n/a |
| Red Hat Openshift Data Foundation 4 | odf4/odf-multicluster-console-rhel9 | Fix deferred | n/a |
| Red Hat Process Automation 7 | org.kie-process-migration-service | Fix deferred | n/a |
| Red Hat build of Apache Camel - HawtIO 4 | io.hawt-project | Fix deferred | n/a |
| Red Hat build of Apicurio Registry 2 | io.apicurio-apicurio-registry | Fix deferred | n/a |
| Self-service automation portal 2 | ansible-automation-platform/automation-portal | Fix deferred | n/a |
| streams for Apache Kafka 2 | com.github.streamshub-console | Fix deferred | n/a |
| streams for Apache Kafka 3 | com.github.streamshub-console | Fix deferred | n/a |
dompurify
npm
Introduced 3.1.3 Fixed 3.3.2dompurify
npm
Introduced 2.5.3 Fixed 2.5.9
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | dompurify | 3.1.3 | 3.3.2 |
| npm | dompurify | 2.5.3 | 2.5.9 |
Remediation
Red Hat mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
References (13)
- https://access.redhat.com/security/cve/CVE-2026-0540 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2444135 Issue Tracking
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-9303 Advisory
- https://fluidattacks.com/advisories/daft third-party-advisory
- https://github.com/advisories/GHSA-v2wj-7wpq-c8vv Advisory
- https://github.com/cure53/DOMPurify product
- https://github.com/cure53/DOMPurify/commit/302b51de22535cc90235472c52e3401bedd46f80 patch
- https://github.com/cure53/DOMPurify/commit/fca0a938b4261ddc9c0293a289935a9029c049f5
- https://github.com/cure53/DOMPurify/releases/tag/3.3.2 release-notes
- https://nvd.nist.gov/vuln/detail/CVE-2026-0540
- https://www.cve.org/CVERecord?id=CVE-2026-0540
- https://www.vulncheck.com/advisories/dompurify-xss-via-missing-rawtext-elements-in-safe-for-xml third-party-advisoryThird Party Advisory
- https://www.vulncheck.com/advisories/dompurify-xss-via-missing-rawtext-elements-in-safeforxml
Change history (0)
No recorded changes yet.