{
  "cveId": "CVE-2026-41238",
  "url": "https://patchblox.com/security/cve/CVE-2026-41238",
  "summary": "CVE-2026-41238 is fixed in node-dompurify on 1 platform by DEBIAN-CVE-2026-41238 (version 3.4.1\u002Bdfsg-1), released May 15, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "node-dompurify: DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG",
  "description": "DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Versions 3.0.1 through 3.3.3 are vulnerable to a prototype pollution-based XSS bypass. When an application uses \u0060DOMPurify.sanitize()\u0060 with the default configuration (no \u0060CUSTOM_ELEMENT_HANDLING\u0060 option), a prior prototype pollution gadget can inject permissive \u0060tagNameCheck\u0060 and \u0060attributeNameCheck\u0060 regex values into \u0060Object.prototype\u0060, causing DOMPurify to allow arbitrary custom elements with arbitrary attributes \u2014 including event handlers \u2014 through sanitization. Version 3.4.0 fixes the issue.",
  "published": "2026-04-23T16:16:26Z",
  "severity": "medium",
  "cvss": 6.9,
  "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N",
  "epss": 0.0027,
  "epssPercentile": 0.19257,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "node-dompurify",
      "release": "Debian 14",
      "fixedVersion": "3.4.1\u002Bdfsg-1",
      "fix": "DEBIAN-CVE-2026-41238",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-41238",
      "released": "2026-05-15T16:01:09Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}