Cross-site scripting in DOMPurify - CVE-2026-41239

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU126560

Cross-site scripting in DOMPurify - CVE-2026-41239

Published: April 20, 2026


Vulnerability identifier: #VU126560
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2026-41239
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary script in the victim's browser.

The vulnerability exists due to improper neutralization of script-related template expressions in SAFE_FOR_TEMPLATES mode in the DOMPurify sanitizer when sanitizing crafted HTML and returning a DOM node with RETURN_DOM enabled. A remote attacker can supply specially crafted markup to execute arbitrary script in the victim's browser.

Exploitation requires the application to append the returned DOM to the document and process it with a client-side framework.


Affected software

DOMPurify
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Maximo Application Suite - Manage Component
IBM Cloud Transformation Advisor
Jazz Reporting Service
IBM Maximo Scheduler Optimization
Rational Performance Tester
DevOps Test Performance
Application Modernization Accelerator

How to mitigate CVE-2026-41239

Install security update from vendor's website.

DOMPurify - update to 3.4.0
IBM Watson Discovery for IBM Cloud Pak for Data - update to 5.3.2
Jazz Reporting Service - addressed in versions 7.0.3 iFix023, 7.1 iFix011, 7.2 iFix003
IBM Maximo Application Suite - Manage Component - addressed in versions 9.0.26, 9.1.18
IBM Maximo Scheduler Optimization - addressed in versions 9.0.25, 9.1.14, 9.2.1
DevOps Test Performance - update to 11.0.8
Application Modernization Accelerator - update to 4.6.2
IBM Cloud Transformation Advisor - update to 4.6.2

External References

Related Security Bulletins