PT-2026-34604

CVE-2026-41240

Published

2026-02-24

Updated

2026-09-25

Description by

CVSS 2.0

6.4

Medium

MetricsAV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions DOMPurify versions prior to 3.4.0

Description An inconsistency exists between the handling of FORBID TAGS and FORBID ATTR when a function-based ADD TAGS configuration is used. Specifically, when the EXTRA ELEMENT HANDLING.tagCheck function returns true, a short-circuit evaluation occurs that bypasses the FORBID TAGS check. This allows forbidden elements, such as iframe, object, embed, and form, to bypass sanitization and remain in the output with their attributes intact.

Recommendations Update to version 3.4.0.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-183: Permissive List of Allowed Inputs

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers