DOMPurify CVE-2026-41238

Exploitation requires three specific prerequisites: (1) The application must use DOMPurify 3.0.1 through 3.3.3 with the default configuration (no CUSTOM_ELEMENT_HANDLING option passed, or CUSTOM_ELEMENT_HANDLING set to null or undefined). Explicitly passing CUSTOM_ELEMENT_HANDLING: {} or CUSTOM_ELEMENT_HANDLING: {tagNameCheck: null, attributeNameCheck: null} prevents the vulnerability. (2) A prototype pollution gadget must be present and exploitable in the application's dependency tree or inline code-this could be lodash < 4.17.21, jQuery.extend, query-string parser, or any deep-merge utility vulnerable to prototype pollution. (3) The attacker must achieve execution context in the same JavaScript runtime-typically through ability to supply user input to a sanitizable content sink. The attack does not require authentication, but does require user interaction (UI:R in CVSS) meaning the polluted payload must be rendered in a victim's browser after triggering the prototype pollution. The vulnerability is NOT exploitable if the application explicitly defines CUSTOM_ELEMENT_HANDLING in the config, if no prototype pollution gadget exists in the application's dependency chain, or if the JavaScript execution context is isolated (e.g., Web Worker without access to Object.prototype of the main thread).

This vulnerability presents moderate real-world risk despite the 6.9 CVSS score. The CVSS vector (AV:N/AC:H/PR:N/UI:R/S:C) indicates network attack surface, high attack complexity (AC:H), no authentication, and requirement for user interaction (UI:R), which aligns with the actual attack scenario: user must trigger XSS when the polluted payload is rendered in their browser. The ACH factor likely reflects the prerequisite requirement that an attacker must first successfully exploit a separate prototype pollution gadget. However, this is not a theoretical concern-prototype pollution vulnerabilities are widespread in npm ecosystem dependencies (lodash before 4.17.21, jQuery.extend, query-string, deep-merge utilities, etc.). The XSS impact is severe (C:H/I:L/A:N suggests confidentiality breach and minor integrity compromise), and the default configuration vulnerability means any application using DOMPurify without explicitly setting CUSTOM_ELEMENT_HANDLING is automatically affected. Risk is further elevated because DOMPurify 3.0.1-3.3.3 represent recent versions that developers would be expected to update to. The vulnerability requires no configuration changes and affects the most common usage pattern. Detection of active exploitation has not yet been independently confirmed at the time of analysis, but the exploit is straightforward to construct given a prototype pollution gadget. Organizations should treat this as high-priority given the prevalence of prototype pollution in frontend libraries and the ubiquity of DOMPurify in security-sensitive applications.

An attacker identifies that a target web application uses both DOMPurify 3.0.1-3.3.3 for HTML sanitization and a vulnerable dependency like lodash with a prototype pollution gadget. The attacker crafts a malicious input payload that first exploits the prototype pollution vulnerability (e.g., by manipulating query parameters or JSON data processed by the vulnerable lodash version) to set Object.prototype.tagNameCheck and Object.prototype.attributeNameCheck to permissive regex patterns. Subsequently, when the application calls DOMPurify.sanitize() on user-controlled content with a custom element and event handler (e.g., <x-pwn onfocus=alert(document.cookie) autofocus>), the sanitizer allows the payload through because its validation logic now resolves the polluted prototype properties. When the sanitized content is injected into the DOM, the event handler fires, stealing cookies or session tokens.