Permissive List of Allowed Inputs in DOMPurify - CVE-2026-41240

Vulnerability identifier: #VU126561

CSH Severity: Low

CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-41240

CWE-ID: CWE-183

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to inject forbidden elements into sanitized output.

The vulnerability exists due to a permissive list of allowed inputs in tag filtering logic when sanitizing content with a function-based ADD_TAGS predicate and FORBID_TAGS configured. A remote user can supply crafted markup that uses forbidden tags to inject forbidden elements into sanitized output.

Only configurations that use a function-based ADD_TAGS predicate are vulnerable.

DOMPurify
Db2 Developer Extension
IBM Maximo Scheduler Optimization
Rational Performance Tester
DevOps Test Performance
InfoSphere Optim Archive Viewer
Application Modernization Accelerator
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Maximo Application Suite - Manage Component
IBM Cloud Transformation Advisor
Jazz Reporting Service
JBoss Data Grid
Fedora
python-jupytext

Install security update from vendor's website.

DOMPurify - update to 3.4.0
Db2 Developer Extension - update to 1.2.0
IBM Watson Discovery for IBM Cloud Pak for Data - update to 5.3.2
Jazz Reporting Service - addressed in versions 7.0.3 iFix023, 7.1 iFix011, 7.2 iFix003
IBM Maximo Scheduler Optimization - addressed in versions 9.0.25, 9.1.14, 9.2.1
IBM Maximo Application Suite - Manage Component - addressed in versions 9.0.26, 9.1.18
DevOps Test Performance - update to 11.0.8
InfoSphere Optim Archive Viewer - update to 11.7.0.15
python-jupytext - addressed in versions 1.19.1-4.fc42, 1.19.1-4.fc43, 1.19.1-4.fc44
Application Modernization Accelerator - update to 4.6.2
IBM Cloud Transformation Advisor - update to 4.6.2
JBoss Data Grid - update to 8.6.1

• https://github.com/cure53/DOMPurify/security/advisories/GHSA-h7mw-gpvr-xq4m

• Multiple vulnerabilities in DOMPurify
• Multiple vulnerabilities in IBM DevOps Test Performance
• Multiple vulnerabilities in IBM Maximo Application Suite - Manage Component
• Multiple vulnerabilities in IBM Application Modernization Accelerator
• Multiple vulnerabilities in IBM Transformation Advisor
• Multiple vulnerabilities in IBM Watson Discovery Cartridge
• Multiple vulnerabilities in JBoss Data Grid 8.6
• Multiple vulnerabilities in IBM Jazz Reporting Service
• Multiple vulnerabilities in IBM Maximo Scheduler Optimization
• Fedora 44 update for python-jupytext
• Fedora 43 update for python-jupytext
• Fedora 42 update for python-jupytext
• Multiple vulnerabilities in IBM Db2 Developer Extension
• Multiple vulnerabilities in IBM InfoSphere Optim Archive Viewer