CVE-2026-0540

A cross site scripting flaw has been discovered in the DOMPurify npm library. This flaw allows attackers to bypass attribute sanitization by exploiting five missing rawtext elements (noscript, xmp, noembed, noframes, iframe) in the SAFE_FOR_XML regex. Attackers can include payloads like </noscript><img src=x onerror=alert(1)> in attribute values to execute JavaScript when sanitized output is placed inside these unprotected rawtext contexts.

A moderate cross-site scripting (XSS) flaw was found in DOMPurify, an HTML sanitization library shipped in multiple Red Hat products, including Red Hat 3scale API Management Platform, Red Hat Ansible Automation Platform, Red Hat AMQ, OpenShift Virtualization console plugins, Cluster Observability Operator, and Cryostat. The SAFE_FOR_XML regex in DOMPurify 3.1.3 through 3.3.1 and 2.5.3 through 2.5.8 does not account for five rawtext elements (noscript, xmp, noembed, noframes, and iframe). An attacker can bypass attribute sanitization by placing payloads such as "</noscript><img src=x onerror=alert(1)>" inside attribute values; when the sanitized output is rendered inside one of these unprotected rawtext contexts, the injected markup is parsed as HTML and the attacker's JavaScript executes in the victim's browser. Exploitation requires an application to place DOMPurify-sanitized output inside such a rawtext element context and requires user interaction, which limits the attack surface. The Red Hat severity (Moderate, CVSS:3.1 6.1, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) matches the upstream rating. Fixes for the affected Red Hat product streams are currently deferred; until a fixed DOMPurify is delivered, applications that render DOMPurify-sanitized content inside noscript, xmp, noembed, noframes, or iframe elements remain exposed to this sanitization bypass. For community-distributed components, handling is delegated to the community, which is pursuing fixes where affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.