CVE-2025-26791 is a mutation-based Cross-site Scripting (mXSS) vulnerability in DOMPurify, caused by improper template literal regular expression handling. This vulnerability allows attackers to inject and execute malicious scripts in affected Red Hat OpenShift Service Mesh containers, specifically versions >=2.5.0 and <2.6.0. The issue is tracked under CWE-79 (Improper Neutralization of Input During Web Page Generation). Red Hat has published an advisory (RHSA-2025:10020) describing the vulnerability, its impact, and references to fixes in DOMPurify upstream. The vulnerability can lead to unauthorized code execution, data disclosure, and bypass of protection mechanisms in web applications using the affected component.

The vulnerability enables attackers to perform mutation-based Cross-site Scripting (mXSS) attacks, potentially leading to unauthorized execution of malicious scripts in the context of affected web applications. This can result in disclosure of sensitive information such as session cookies, unauthorized actions performed on behalf of users, and compromise of user accounts. The impact includes confidentiality and integrity loss, but no direct availability impact. The severity is assessed as medium by Red Hat.

Red Hat has published an official security advisory (RHSA-2025:10020) detailing the vulnerability and remediation steps. Users of Red Hat OpenShift Service Mesh versions >=2.5.0 and <2.6.0 should apply the updates provided by Red Hat to address this issue. Refer to Red Hat's official documentation and advisories for instructions on applying the fix. No additional mitigations are specified beyond applying the official update.