DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG.

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Apr 23, 2026 · NIST NVD

   Detected

   DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Starting in version 1.0.10 and prior to version 3.4.0, strips expressions from untrusted HTML. This works in string mode but not with or , allowing XSS via template-evaluating frameworks like Vue 2. Version 3.4.0 patches the issue.

2. Jun 17, 2026 · NIST NVD

   Updated

   DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Starting in version 1.0.10 and prior to version 3.4.0, strips expressions from untrusted HTML. This works in string mode but not with or , allowing XSS via template-evaluating frameworks like Vue 2. Version 3.4.0 patches the issue.

Sources

• CVE.orgVulnerability recordCVE-2026-41239

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-41239

  DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Starting in version 1.0.10 and prior to version 3.4.0, strips expressions from untrusted HTML. This works in string mode but not with or `RETURN_DOM_FRAGM

  nvd.nist.gov

References

• Reference · github.com
• Reference · github.com