CVE-2026-41240: DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix)
DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Versions prior to 3.4.0 have an inconsistency between FORBID_TAGS and FORBID_ATTR handling when function-based ADD_TAGS is used. Commit c361baa added an early exit for FORBID_ATTR at line 1214. The same fix was not applied to FORBID_TAGS. At line 1118-1123, when EXTRA_ELEMENT_HANDLING.tagCheck returns true, the short-circuit evaluation skips the FORBID_TAGS check entirely. This allows forbidden elements to survive sanitization with their attributes intact. Version 3.4.0 patches the issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41240?
CVE-2026-41240 is classified as a medium severity vulnerability.
How do I fix CVE-2026-41240?
To mitigate CVE-2026-41240, upgrade DOMPurify to version 3.4.0 or later.
What does the CVE-2026-41240 vulnerability affect?
CVE-2026-41240 affects the handling of FORBID_TAGS and is related to a bypass vulnerability in DOMPurify.
Which versions of DOMPurify are affected by CVE-2026-41240?
Versions of DOMPurify prior to 3.4.0 are affected by CVE-2026-41240.
What is the nature of the issue described in CVE-2026-41240?
CVE-2026-41240 describes an inconsistency in the handling of the FORBID_TAGS and FORBID_ATTR predicates.