CVE-2026-41239: DOMPurify XSS Vulnerability

CVE-2026-41239 Overview

CVE-2026-41239 is a Cross-Site Scripting (XSS) vulnerability in DOMPurify, a widely-used DOM-only sanitizer for HTML, MathML, and SVG content. The vulnerability exists in the SAFE_FOR_TEMPLATES configuration option, which is designed to strip template expressions like {{...}} from untrusted HTML to prevent XSS attacks in template-evaluating frameworks. However, this protection only functions correctly in string mode and fails to sanitize template expressions when using RETURN_DOM or RETURN_DOM_FRAGMENT modes, allowing attackers to inject malicious template expressions that can be evaluated by frameworks like Vue 2.

Critical Impact

Applications using DOMPurify with SAFE_FOR_TEMPLATES enabled alongside RETURN_DOM or RETURN_DOM_FRAGMENT modes in combination with template-evaluating frameworks (such as Vue 2) are vulnerable to XSS attacks that bypass the sanitization controls.

Affected Products

• DOMPurify versions 1.0.10 through 3.3.x
• Applications using SAFE_FOR_TEMPLATES with RETURN_DOM or RETURN_DOM_FRAGMENT
• Web applications integrating DOMPurify with Vue 2 or similar template-evaluating frameworks

Discovery Timeline

• 2026-04-23 - CVE CVE-2026-41239 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2026-41239

Vulnerability Analysis

This vulnerability represents a critical flaw in DOMPurify's template expression sanitization logic. The SAFE_FOR_TEMPLATES option was introduced to protect against XSS attacks in applications that use client-side template engines by stripping dangerous template expressions such as {{...}}, <%...%>, and similar patterns that could be interpreted and executed by frameworks like Vue.js, AngularJS, or other template-based systems.

The root of the vulnerability lies in an inconsistent implementation of the sanitization routine across different return modes. When DOMPurify returns sanitized content as a string (default behavior), the template expression stripping works as expected. However, when applications configure DOMPurify to return a DOM node (RETURN_DOM: true) or a DocumentFragment (RETURN_DOM_FRAGMENT: true), the template expression sanitization is bypassed entirely.

This inconsistency creates a dangerous security gap for applications that rely on DOM return modes for performance reasons or architectural requirements, while simultaneously depending on SAFE_FOR_TEMPLATES for XSS protection.

Root Cause

The vulnerability stems from the SAFE_FOR_TEMPLATES sanitization logic being implemented only in the string serialization path of DOMPurify's output generation. When DOM nodes or fragments are returned directly, the code path responsible for stripping template expressions is not executed, leaving the dangerous template syntax intact within the returned DOM structure. This is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation).

Attack Vector

An attacker can exploit this vulnerability by crafting malicious HTML input containing template expressions such as {{constructor.constructor('alert(document.cookie)')()}} for Vue 2. When this input is processed by a vulnerable DOMPurify configuration that uses RETURN_DOM or RETURN_DOM_FRAGMENT with SAFE_FOR_TEMPLATES enabled, the template expressions pass through unsanitized. If the resulting DOM is subsequently processed by a template-evaluating framework like Vue 2, the malicious expressions are evaluated, resulting in JavaScript execution in the context of the victim's browser session.

The attack requires network access and user interaction (such as viewing a page containing the malicious content), but no authentication or special privileges are needed to craft and deliver the malicious payload.

Detection Methods for CVE-2026-41239

Indicators of Compromise

• Unusual template expression patterns in user-generated content containing JavaScript code or prototype chain access
• Client-side JavaScript errors related to unexpected template evaluation in Vue.js or similar frameworks
• Detection of payloads containing nested constructor calls like {{constructor.constructor(...)()}}
• Web application firewall logs showing attempts to inject {{...}} patterns with JavaScript code

Detection Strategies

• Audit application code for DOMPurify configurations that combine SAFE_FOR_TEMPLATES with RETURN_DOM or RETURN_DOM_FRAGMENT options
• Implement Content Security Policy (CSP) headers to detect and prevent inline script execution from template injection
• Monitor JavaScript console errors for unexpected template compilation or evaluation attempts
• Review web server access logs for patterns consistent with template injection payloads

Monitoring Recommendations

• Enable verbose logging for user input handling in applications using DOMPurify
• Implement real-time alerting for CSP violation reports that may indicate XSS exploitation attempts
• Deploy browser-based XSS detection through SentinelOne's endpoint protection capabilities
• Monitor for anomalous DOM manipulation patterns that could indicate successful exploitation

How to Mitigate CVE-2026-41239

Immediate Actions Required

• Upgrade DOMPurify to version 3.4.0 or later immediately
• Review all DOMPurify configurations in your codebase for the vulnerable combination of options
• If immediate upgrade is not possible, switch from RETURN_DOM or RETURN_DOM_FRAGMENT to string return mode when SAFE_FOR_TEMPLATES is required
• Implement defense-in-depth with strict Content Security Policy headers to mitigate potential bypass scenarios

Patch Information

The vulnerability has been addressed in DOMPurify version 3.4.0. The fix ensures that template expression sanitization is consistently applied regardless of the return mode configured. Organizations should update to this version or later to remediate the vulnerability. For detailed information, refer to the GitHub DOMPurify Release 3.4.0 and the GitHub Security Advisory GHSA-crv5-9vww-q3g8.

Workarounds

• Avoid using RETURN_DOM or RETURN_DOM_FRAGMENT options when SAFE_FOR_TEMPLATES protection is required
• Implement additional server-side sanitization for template expressions before passing content to DOMPurify
• Consider using a secondary sanitization pass on the serialized output when DOM return modes are architecturally necessary
• Disable template evaluation in client-side frameworks for untrusted content sections where possible

# Update DOMPurify to patched version
npm update dompurify@^3.4.0

# Or install specific version
npm install dompurify@3.4.0