DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Versions 3.0.1 through 3.3.3 are vulnerable to a prototype pollution-based XSS bypass. When an application uses `DOMPurify.sanitize()` with the default configuration (no `CUSTOM_ELEMENT_HANDLING` option), a prior prototype pollution gadget can inject permissive `tagNameCheck` and `attributeNameCheck` regex values into `Object.prototype`, causing DOMPurify to allow arbitrary custom elements with arbitrary attributes — including event handlers — through sanitization. Version 3.4.0 fixes the issue.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Versions 3.0.1 through     3.3.3 are vulnerable to a prototype pollution-based XSS bypass. When an application uses     `DOMPurify.sanitize()` with the default configuration (no `CUSTOM_ELEMENT_HANDLING` option), a prior     prototype pollution gadget can inject permissive `tagNameCheck` and `attributeNameCheck` regex values into     `Object.prototype`, causing DOMPurify to allow arbitrary custom elements with arbitrary attributes     including event handlers  through sanitization. Version 3.4.0 fixes the issue. (CVE-2026-41238)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Versions 3.0.1 through
    3.3.3 are vulnerable to a prototype pollution-based XSS bypass. When an application uses
    `DOMPurify.sanitize()` with the default configuration (no `CUSTOM_ELEMENT_HANDLING` option), a prior
    prototype pollution gadget can inject permissive `tagNameCheck` and `attributeNameCheck` regex values into
    `Object.prototype`, causing DOMPurify to allow arbitrary custom elements with arbitrary attributes —
    including event handlers — through sanitization. Version 3.4.0 fixes the issue. (CVE-2026-41238)

ID	Name	Product	Family	Severity
310042	Linux Distros Unpatched Vulnerability : CVE-2026-41238	Nessus	Misc.	medium
440719	SCA: security update for dompurify (GHSA-v9jr-rg53-9pgp)	Tenable Cloud Security	SCA Checks	medium
440719	SCA: security update for dompurify (GHSA-v9jr-rg53-9pgp)	Tenable Self-Hosted Container Security	SCA Checks	medium

Detections

Analytics

CVE-2026-41238

medium

Tenable Plugins

medium

medium

medium