Prototype pollution in DOMPurify - CVE-2026-41238

Vulnerability identifier: #VU126559

CSH Severity: Medium

CVSS v4: 5.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-41238

CWE-ID: CWE-1321

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary script in a victim's browser.

The vulnerability exists due to improperly controlled modification of object prototype attributes in DOMPurify sanitize configuration handling when sanitizing user-supplied HTML with the default CUSTOM_ELEMENT_HANDLING behavior. A remote attacker can supply crafted HTML and leverage prior prototype pollution to execute arbitrary script in a victim's browser.

User interaction is required, and exploitation requires a prototype pollution primitive in the same execution context.

DOMPurify
Db2 Developer Extension
IBM Maximo Scheduler Optimization
Rational Performance Tester
DevOps Test Performance
InfoSphere Optim Archive Viewer
Application Modernization Accelerator
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Maximo Application Suite - Manage Component
IBM Cloud Transformation Advisor

Install security update from vendor's website.

DOMPurify - update to 3.4.0
Db2 Developer Extension - update to 1.2.0
IBM Watson Discovery for IBM Cloud Pak for Data - update to 5.3.2
IBM Maximo Scheduler Optimization - addressed in versions 9.0.25, 9.1.14, 9.2.1
IBM Maximo Application Suite - Manage Component - addressed in versions 9.0.26, 9.1.18
DevOps Test Performance - update to 11.0.8
InfoSphere Optim Archive Viewer - update to 11.7.0.15
Application Modernization Accelerator - update to 4.6.2
IBM Cloud Transformation Advisor - update to 4.6.2

• https://github.com/cure53/DOMPurify/security/advisories/GHSA-v9jr-rg53-9pgp
• https://github.com/advisories/GHSA-v9jr-rg53-9pgp

• Multiple vulnerabilities in DOMPurify
• Multiple vulnerabilities in IBM DevOps Test Performance
• Multiple vulnerabilities in IBM Maximo Application Suite - Manage Component
• Multiple vulnerabilities in IBM Application Modernization Accelerator
• Multiple vulnerabilities in IBM Transformation Advisor
• Multiple vulnerabilities in IBM Watson Discovery Cartridge
• Multiple vulnerabilities in IBM Maximo Scheduler Optimization
• Multiple vulnerabilities in IBM Db2 Developer Extension
• Multiple vulnerabilities in IBM InfoSphere Optim Archive Viewer