DOMPurify is a sanitizer designed to prevent cross-site scripting by cleaning HTML, MathML, and SVG inputs. In versions before 3.4.0, an inconsistency exists in how forbidden tags and attributes are processed: an early exit was added for forbidden attributes but not for forbidden tags, causing the FORBID_TAGS check to be skipped under certain conditions. This permits forbidden elements to survive sanitization with their attributes, potentially enabling injection of malicious content. The vulnerability is tracked as CVE-2026-41240 and was addressed in version 3.4.0.

The vulnerability allows forbidden HTML elements to bypass sanitization and remain in the output with their attributes intact, increasing the risk of cross-site scripting (XSS) attacks. This can lead to execution of malicious scripts in the context of the affected application, potentially compromising user data or session integrity. The CVSS 4.0 score is 6.0 (medium severity), reflecting network attack vector, low attack complexity, partial attack complexity, no privileges required, user interaction required, and high impact on integrity.

Upgrade to DOMPurify version 3.4.0 or later, where this issue is fixed. There is no official patch or temporary fix other than upgrading. Users should verify that their sanitization configurations do not rely on the vulnerable behavior and ensure that FORBID_TAGS is properly enforced by using the patched version.