CVE-2026-41240

UNKNOWN 0.0

DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix)

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Versions prior to 3.4.0 have an inconsistency between FORBID_TAGS and FORBID_ATTR handling when function-based ADD_TAGS is used. Commit c361baa added an early exit for FORBID_ATTR at line 1214. The same fix was not applied to FORBID_TAGS. At line 1118-1123, when EXTRA_ELEMENT_HANDLING.tagCheck returns true, the short-circuit evaluation skips the FORBID_TAGS check entirely. This allows forbidden elements to survive sanitization with their attributes intact. Version 3.4.0 patches the issue.

CWE	CWE-183 CWE-79
Vendor	cure53
Product	dompurify
Published	Apr 23, 2026
Last Updated	Apr 23, 2026

Stay Ahead of the Next One

Get instant alerts for cure53 dompurify

Be the first to know when new unknown vulnerabilities affecting cure53 dompurify are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

cure53 / DOMPurify

< 3.4.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/cure53/DOMPurify/security/advisories/GHSA-h7mw-gpvr-xq4m github.com: https://github.com/cure53/DOMPurify/commit/c361baa18dbdcb3344a41110f4c48ad85bf48f80 github.com: https://github.com/cure53/DOMPurify/releases/tag/3.4.0