CVE-2026-41240

A flaw was found in DOMPurify, a DOM-only cross-site scripting sanitizer. A remote attacker could exploit an inconsistency in how forbidden tags and attributes are handled when function-based tag additions are used. This allows malicious HTML, MathML, or SVG elements to bypass sanitization and execute arbitrary code in the user's browser, leading to Cross-Site Scripting (XSS).

Red Hat Product Security has rated this vulnerability as Moderate because exploitation requires a specialized and uncommon configuration where dynamic callback functions are defined for element handling. In typical Red Hat deployments incorporating DOMPurify, web consoles and interfaces rely on default or static sanitization profiles rather than function-based tag evaluation. Furthermore, successful exploitation requires user interaction to process malicious markup, limiting the attack surface to scenarios where an authenticated victim is tricked into viewing attacker-controlled input.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.