CVE-2026-41240 is a cross-site scripting vulnerability in DOMPurify, a DOM-only XSS sanitizer used in OpenShift Virtualization v4.14 images. The flaw arises from inconsistent handling of forbidden tags and attributes when function-based tag additions are used, allowing malicious elements to bypass sanitization and execute arbitrary code in the browser. Red Hat has identified this issue affecting multiple OpenShift Virtualization versions, including 4.13, 4.14, 4.15, 4.17, 4.18, 4.19, 4.21, and related container-native virtualization images. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), CWE-915, and CWE-289. Red Hat currently does not provide a patch or mitigation that meets their criteria for ease of use, applicability, and stability. The advisory recommends ensuring all previously released errata are applied and monitoring for future updates.

Successful exploitation allows remote attackers to execute arbitrary code in the user's browser via cross-site scripting, potentially leading to disclosure of sensitive information such as session cookies, unauthorized actions performed on behalf of the user, and compromise of user accounts. The vulnerability affects confidentiality and integrity but does not impact availability. No known exploits are reported in the wild at this time.

No official patch or mitigation meeting Red Hat's criteria is currently available for this vulnerability. Users should ensure all previously released errata relevant to their systems are applied. Monitor Red Hat advisories for updates or fixes. Consider applying any vendor-recommended mitigations if they become available in the future.