Search: CVE-2026-41239

1 threat

Severity	CVSS	Signals	Threat	Source	Published	Score and star
Medium	6.8	EPSS 0.2%	CVE-2026-41239cure53 DOMPurify · Cross-site Scripting Medium6.8EPSS 0.2%2026-04-23CVE Database V5CVE-2026-41239 DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Starting in version 1.0.10 and prior to version 3.4.0, `SAFE_FOR_TEMPLATES` strips `{{...}}` expressions from untrusted HTML. This works in string mode but not with `RETURN_DOM` or `RETURN_DOM_FRAGMENT`, allowing XSS via template-evaluating frameworks like Vue 2. Version 3.4.0 patches the issue. EPSS 0.2%Vulnerability CWE-79	CVE Database V5	2026-04-23

Page 1 of 1