Prototype pollution in DOMPurify - CVE-2026-41238

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU126559

Prototype pollution in DOMPurify - CVE-2026-41238

Published: April 20, 2026


Vulnerability identifier: #VU126559
CSH Severity: Medium
CVSS v4: 5.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-41238
CWE-ID: CWE-1321
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary script in a victim's browser.

The vulnerability exists due to improperly controlled modification of object prototype attributes in DOMPurify sanitize configuration handling when sanitizing user-supplied HTML with the default CUSTOM_ELEMENT_HANDLING behavior. A remote attacker can supply crafted HTML and leverage prior prototype pollution to execute arbitrary script in a victim's browser.

User interaction is required, and exploitation requires a prototype pollution primitive in the same execution context.


Affected software

DOMPurify
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Maximo Application Suite - Manage Component
IBM Cloud Transformation Advisor
IBM Maximo Scheduler Optimization
Rational Performance Tester
DevOps Test Performance
Application Modernization Accelerator

How to mitigate CVE-2026-41238

Install security update from vendor's website.

DOMPurify - update to 3.4.0
IBM Watson Discovery for IBM Cloud Pak for Data - update to 5.3.2
IBM Maximo Application Suite - Manage Component - addressed in versions 9.0.26, 9.1.18
IBM Maximo Scheduler Optimization - addressed in versions 9.0.25, 9.1.14, 9.2.1
DevOps Test Performance - update to 11.0.8
Application Modernization Accelerator - update to 4.6.2
IBM Cloud Transformation Advisor - update to 4.6.2

External References

Related Security Bulletins