DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix)
Published Apr 23, 2026
6.0
MEDIUMCVSS 4.0
EPSS 0.40%
Description
DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Versions prior to 3.4.0 have an inconsistency between FORBID_TAGS and FORBID_ATTR handling when function-based ADD_TAGS is used. Commit c361baa added an early exit for FORBID_ATTR at line 1214. The same fix was not applied to FORBID_TAGS. At line 1118-1123, when EXTRA_ELEMENT_HANDLING.tagCheck returns true, the short-circuit evaluation skips the FORBID_TAGS check entirely. This allows forbidden elements to survive sanitization with their attributes intact. Version 3.4.0 patches the issue.
Affected products
-
Affected
- < 3.4.0
No data.
Cryostat 4 on RHEL 9
cryostat/cryostat-openshift-console-plugin-rhel9:4.2.0-10
Fixed · RHSA-2026:28010
Cryostat 4 on RHEL 9
cryostat/cryostat-rhel9:4.2.0-10
Fixed · RHSA-2026:28010
Red Hat Ansible Automation Platform 2.6 for RHEL 9
automation-platform-ui-0:2.6.10-1.el9ap
Fixed · RHSA-2026:34160
Red Hat Container Native Virtualization 4.13
container-native-virtualization/kubevirt-console-plugin-rhel9:1782426816
Fixed · RHSA-2026:36108
Red Hat Container Native Virtualization 4.14
container-native-virtualization/kubevirt-console-plugin-rhel9:1781807944
Fixed · RHSA-2026:27944
Red Hat Container Native Virtualization 4.15
container-native-virtualization/kubevirt-console-plugin-rhel9:1782917983
Fixed · RHSA-2026:36107
Red Hat Container Native Virtualization 4.17
container-native-virtualization/kubevirt-console-plugin-rhel9:1781822441
Fixed · RHSA-2026:28001
Red Hat Container Native Virtualization 4.18
container-native-virtualization/kubevirt-console-plugin-rhel9:1781808146
Fixed · RHSA-2026:27875
Red Hat Container Native Virtualization 4.19
container-native-virtualization/kubevirt-console-plugin-rhel9:1781821991
Fixed · RHSA-2026:27872
Red Hat Container Native Virtualization 4.20
container-native-virtualization/kubevirt-console-plugin-rhel9:1781824266
Fixed · RHSA-2026:27967
Red Hat Container Native Virtualization 4.21
container-native-virtualization/kubevirt-console-plugin-rhel9:1781738713
Fixed · RHSA-2026:27879
Red Hat Data Grid 8.6.1
dompurify
Fixed · RHSA-2026:22619
Red Hat Developer Hub 1.8
rhdh/rhdh-hub-rhel9:1779841586
Fixed · RHSA-2026:21338
Red Hat OpenShift AI 2.25
rhoai/odh-dashboard-rhel9:1780467029
Fixed · RHSA-2026:24977
Red Hat OpenShift AI 2.25
rhoai/odh-mod-arch-model-registry-rhel9:1780467147
Fixed · RHSA-2026:24977
Red Hat OpenShift Dev Spaces 3.28
devspaces/code-rhel9:1779814592
Fixed · RHSA-2026:21772
Red Hat OpenShift Dev Spaces 3.28
devspaces/openvsx-rhel9:1779528224
Fixed · RHSA-2026:21772
Red Hat OpenShift Service Mesh 2.6
openshift-service-mesh/kiali-ossmc-rhel8:1778191473
Fixed · RHSA-2026:16476
Red Hat build of Apicurio Registry 3.3.1
apicurio/apicurio-registry-ui-rhel8
Fixed · RHSA-2026:59360
Red Hat build of Apicurio Registry 3.3.1
apicurio/apicurio-registry-ui-rhel9
Fixed · RHSA-2026:59360
Streams for Apache Kafka 2.9.4
dompurify
Fixed · RHSA-2026:34608
Cryostat 4
cryostat-openshift-console-plugin-npm
Affected
Migration Toolkit for Virtualization
migration-toolkit-virtualization/mtv-console-plugin-rhel9
Not affected
Migration Toolkit for Virtualization
mtv-candidate/mtv-console-plugin-rhel9
Will not fix
Multicluster Engine for Kubernetes
multicluster-engine/console-mce-rhel9
Not affected
Node HealthCheck Operator
workload-availability/node-healthcheck-must-gather-rhel9
Not affected
Node HealthCheck Operator
workload-availability/node-healthcheck-operator-bundle
Not affected
Node HealthCheck Operator
workload-availability/node-healthcheck-rhel9-operator
Not affected
OpenShift Lightspeed
openshift-lightspeed/lightspeed-console-plugin-419-rhel9
Not affected
OpenShift Lightspeed
openshift-lightspeed/lightspeed-console-plugin-rhel9
Not affected
OpenShift Service Mesh 3
openshift-service-mesh/kiali-ossmc-rhel9
Not affected
OpenShift Service Mesh 3
openshift-service-mesh/kiali-rhel9
Not affected
Red Hat 3scale API Management Platform 2
3scale-amp2/system-rhel7
Not affected
Red Hat 3scale API Management Platform 2
3scale-amp2/system-rhel8
Will not fix
Red Hat 3scale API Management Platform 2
3scale-amp2/system-rhel9
Not affected
Red Hat 3scale API Management Platform 2
3scale-amp21/system
Not affected
Red Hat 3scale API Management Platform 2
3scale-amp22/system
Not affected
Red Hat Advanced Cluster Security 4
advanced-cluster-security/rhacs-main-rhel8
Not affected
Red Hat Ansible Automation Platform 2
ansible-automation-platform-26/gateway-rhel9
Not affected
Red Hat Ansible Automation Platform 2
automation-controller
Not affected
Red Hat Ansible Automation Platform 2
automation-eda-controller
Not affected
Red Hat Ansible Automation Platform 2
automation-gateway
Not affected
Red Hat Build of Podman Desktop
rh-podman-desktop.git
Not affected
Red Hat Ceph Storage 9
rhceph/alloy-rhel10
Affected
Red Hat Enterprise Linux 10
grafana
Not affected
Red Hat Enterprise Linux 8
grafana
Not affected
Red Hat Enterprise Linux 9
grafana
Not affected
Red Hat Hardened Images
ruff
Not affected
Red Hat OpenShift AI (RHOAI)
rhoai/odh-dashboard-rhel8
Not affected
Red Hat OpenShift AI (RHOAI)
rhoai/odh-mod-arch-gen-ai-rhel9
Affected
Red Hat OpenShift AI (RHOAI)
rhoai/odh-mod-arch-maas-rhel9
Not affected
Red Hat OpenShift Container Platform 4
openshift3/ose-console
Affected
Red Hat OpenShift Container Platform 4
openshift4/ose-console
Not affected
Red Hat OpenShift Container Platform 4
openshift4/ose-console-rhel9
Not affected
Red Hat OpenShift Container Platform 4
openshift4/ose-monitoring-plugin-rhel9
Not affected
Red Hat OpenShift GitOps
openshift-gitops-1/argocd-rhel8
Affected
Red Hat OpenShift GitOps
openshift-gitops-1/argocd-rhel9
Affected
Red Hat OpenShift Virtualization 4
container-native-virtualization/kubevirt-console-plugin
Not affected
Red Hat Openshift Data Foundation 4
odf4/ocs-client-console-rhel9
Affected
Red Hat Openshift Data Foundation 4
odf4/odf-console-rhel8
Affected
Red Hat Openshift Data Foundation 4
odf4/odf-console-rhel9
Affected
Red Hat Openshift Data Foundation 4
odf4/odf-multicluster-console-rhel8
Affected
Red Hat Openshift Data Foundation 4
odf4/odf-multicluster-console-rhel9
Affected
Red Hat Process Automation 7
dompurify
Not affected
Red Hat build of Apache Camel - HawtIO 4
dompurify
Not affected
Red Hat build of Apicurio Registry 2
dompurify
Will not fix
Self-service automation portal 2
ansible-automation-platform/automation-portal
Affected
streams for Apache Kafka 3
dompurify
Not affected
| Product | Package | State | Advisory |
|---|---|---|---|
| Cryostat 4 on RHEL 9 | cryostat/cryostat-openshift-console-plugin-rhel9:4.2.0-10 | Fixed | RHSA-2026:28010 |
| Cryostat 4 on RHEL 9 | cryostat/cryostat-rhel9:4.2.0-10 | Fixed | RHSA-2026:28010 |
| Red Hat Ansible Automation Platform 2.6 for RHEL 9 | automation-platform-ui-0:2.6.10-1.el9ap | Fixed | RHSA-2026:34160 |
| Red Hat Container Native Virtualization 4.13 | container-native-virtualization/kubevirt-console-plugin-rhel9:1782426816 | Fixed | RHSA-2026:36108 |
| Red Hat Container Native Virtualization 4.14 | container-native-virtualization/kubevirt-console-plugin-rhel9:1781807944 | Fixed | RHSA-2026:27944 |
| Red Hat Container Native Virtualization 4.15 | container-native-virtualization/kubevirt-console-plugin-rhel9:1782917983 | Fixed | RHSA-2026:36107 |
| Red Hat Container Native Virtualization 4.17 | container-native-virtualization/kubevirt-console-plugin-rhel9:1781822441 | Fixed | RHSA-2026:28001 |
| Red Hat Container Native Virtualization 4.18 | container-native-virtualization/kubevirt-console-plugin-rhel9:1781808146 | Fixed | RHSA-2026:27875 |
| Red Hat Container Native Virtualization 4.19 | container-native-virtualization/kubevirt-console-plugin-rhel9:1781821991 | Fixed | RHSA-2026:27872 |
| Red Hat Container Native Virtualization 4.20 | container-native-virtualization/kubevirt-console-plugin-rhel9:1781824266 | Fixed | RHSA-2026:27967 |
| Red Hat Container Native Virtualization 4.21 | container-native-virtualization/kubevirt-console-plugin-rhel9:1781738713 | Fixed | RHSA-2026:27879 |
| Red Hat Data Grid 8.6.1 | dompurify | Fixed | RHSA-2026:22619 |
| Red Hat Developer Hub 1.8 | rhdh/rhdh-hub-rhel9:1779841586 | Fixed | RHSA-2026:21338 |
| Red Hat OpenShift AI 2.25 | rhoai/odh-dashboard-rhel9:1780467029 | Fixed | RHSA-2026:24977 |
| Red Hat OpenShift AI 2.25 | rhoai/odh-mod-arch-model-registry-rhel9:1780467147 | Fixed | RHSA-2026:24977 |
| Red Hat OpenShift Dev Spaces 3.28 | devspaces/code-rhel9:1779814592 | Fixed | RHSA-2026:21772 |
| Red Hat OpenShift Dev Spaces 3.28 | devspaces/openvsx-rhel9:1779528224 | Fixed | RHSA-2026:21772 |
| Red Hat OpenShift Service Mesh 2.6 | openshift-service-mesh/kiali-ossmc-rhel8:1778191473 | Fixed | RHSA-2026:16476 |
| Red Hat build of Apicurio Registry 3.3.1 | apicurio/apicurio-registry-ui-rhel8 | Fixed | RHSA-2026:59360 |
| Red Hat build of Apicurio Registry 3.3.1 | apicurio/apicurio-registry-ui-rhel9 | Fixed | RHSA-2026:59360 |
| Streams for Apache Kafka 2.9.4 | dompurify | Fixed | RHSA-2026:34608 |
| Cryostat 4 | cryostat-openshift-console-plugin-npm | Affected | n/a |
| Migration Toolkit for Virtualization | migration-toolkit-virtualization/mtv-console-plugin-rhel9 | Not affected | n/a |
| Migration Toolkit for Virtualization | mtv-candidate/mtv-console-plugin-rhel9 | Will not fix | n/a |
| Multicluster Engine for Kubernetes | multicluster-engine/console-mce-rhel9 | Not affected | n/a |
| Node HealthCheck Operator | workload-availability/node-healthcheck-must-gather-rhel9 | Not affected | n/a |
| Node HealthCheck Operator | workload-availability/node-healthcheck-operator-bundle | Not affected | n/a |
| Node HealthCheck Operator | workload-availability/node-healthcheck-rhel9-operator | Not affected | n/a |
| OpenShift Lightspeed | openshift-lightspeed/lightspeed-console-plugin-419-rhel9 | Not affected | n/a |
| OpenShift Lightspeed | openshift-lightspeed/lightspeed-console-plugin-rhel9 | Not affected | n/a |
| OpenShift Service Mesh 3 | openshift-service-mesh/kiali-ossmc-rhel9 | Not affected | n/a |
| OpenShift Service Mesh 3 | openshift-service-mesh/kiali-rhel9 | Not affected | n/a |
| Red Hat 3scale API Management Platform 2 | 3scale-amp2/system-rhel7 | Not affected | n/a |
| Red Hat 3scale API Management Platform 2 | 3scale-amp2/system-rhel8 | Will not fix | n/a |
| Red Hat 3scale API Management Platform 2 | 3scale-amp2/system-rhel9 | Not affected | n/a |
| Red Hat 3scale API Management Platform 2 | 3scale-amp21/system | Not affected | n/a |
| Red Hat 3scale API Management Platform 2 | 3scale-amp22/system | Not affected | n/a |
| Red Hat Advanced Cluster Security 4 | advanced-cluster-security/rhacs-main-rhel8 | Not affected | n/a |
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-26/gateway-rhel9 | Not affected | n/a |
| Red Hat Ansible Automation Platform 2 | automation-controller | Not affected | n/a |
| Red Hat Ansible Automation Platform 2 | automation-eda-controller | Not affected | n/a |
| Red Hat Ansible Automation Platform 2 | automation-gateway | Not affected | n/a |
| Red Hat Build of Podman Desktop | rh-podman-desktop.git | Not affected | n/a |
| Red Hat Ceph Storage 9 | rhceph/alloy-rhel10 | Affected | n/a |
| Red Hat Enterprise Linux 10 | grafana | Not affected | n/a |
| Red Hat Enterprise Linux 8 | grafana | Not affected | n/a |
| Red Hat Enterprise Linux 9 | grafana | Not affected | n/a |
| Red Hat Hardened Images | ruff | Not affected | n/a |
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-dashboard-rhel8 | Not affected | n/a |
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-mod-arch-gen-ai-rhel9 | Affected | n/a |
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-mod-arch-maas-rhel9 | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift3/ose-console | Affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-console | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-console-rhel9 | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-monitoring-plugin-rhel9 | Not affected | n/a |
| Red Hat OpenShift GitOps | openshift-gitops-1/argocd-rhel8 | Affected | n/a |
| Red Hat OpenShift GitOps | openshift-gitops-1/argocd-rhel9 | Affected | n/a |
| Red Hat OpenShift Virtualization 4 | container-native-virtualization/kubevirt-console-plugin | Not affected | n/a |
| Red Hat Openshift Data Foundation 4 | odf4/ocs-client-console-rhel9 | Affected | n/a |
| Red Hat Openshift Data Foundation 4 | odf4/odf-console-rhel8 | Affected | n/a |
| Red Hat Openshift Data Foundation 4 | odf4/odf-console-rhel9 | Affected | n/a |
| Red Hat Openshift Data Foundation 4 | odf4/odf-multicluster-console-rhel8 | Affected | n/a |
| Red Hat Openshift Data Foundation 4 | odf4/odf-multicluster-console-rhel9 | Affected | n/a |
| Red Hat Process Automation 7 | dompurify | Not affected | n/a |
| Red Hat build of Apache Camel - HawtIO 4 | dompurify | Not affected | n/a |
| Red Hat build of Apicurio Registry 2 | dompurify | Will not fix | n/a |
| Self-service automation portal 2 | ansible-automation-platform/automation-portal | Affected | n/a |
| streams for Apache Kafka 3 | dompurify | Not affected | n/a |
dompurify
npm
Introduced 0 Fixed 3.4.0
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | dompurify | 0 | 3.4.0 |
Remediation
Red Hat mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
References (9)
- https://access.redhat.com/security/cve/CVE-2026-41240 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2461147 Issue Tracking
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-25238 Advisory
- https://github.com/advisories/GHSA-h7mw-gpvr-xq4m Advisory
- https://github.com/cure53/DOMPurify/commit/c361baa18dbdcb3344a41110f4c48ad85bf48f80 x_refsource_MISCPatch
- https://github.com/cure53/DOMPurify/releases/tag/3.4.0 x_refsource_MISCProductRelease Notes
- https://github.com/cure53/DOMPurify/security/advisories/GHSA-h7mw-gpvr-xq4m exploitx_refsource_CONFIRMMitigationPatchVendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-41240
- https://www.cve.org/CVERecord?id=CVE-2026-41240
| Link | Providers | Tags |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2026-41240 | Vendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2461147 | Issue Tracking | |
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-25238 | Advisory | |
| https://github.com/advisories/GHSA-h7mw-gpvr-xq4m | Advisory | |
| https://github.com/cure53/DOMPurify/commit/c361baa18dbdcb3344a41110f4c48ad85bf48f80 | x_refsource_MISCPatch | |
| https://github.com/cure53/DOMPurify/releases/tag/3.4.0 | x_refsource_MISCProductRelease Notes | |
| https://github.com/cure53/DOMPurify/security/advisories/GHSA-h7mw-gpvr-xq4m | exploitx_refsource_CONFIRMMitigationPatchVendor Advisory | |
| https://nvd.nist.gov/vuln/detail/CVE-2026-41240 | ||
| https://www.cve.org/CVERecord?id=CVE-2026-41240 |
Change history (0)
No recorded changes yet.
CVE.org / MITRE
CISA Vulnrichment
GitHub