CVE-2026-0540: 
JavaScript vulnerability analysis and mitigation

CVE-2026-0540 is a cross-site scripting (XSS) vulnerability in DOMPurify, a widely used HTML sanitization library maintained by cure53. The flaw affects DOMPurify versions 3.1.3 through 3.3.1 and 2.5.3 through 2.5.8, and stems from five missing rawtext elements (noscript, xmp, noembed, noframes, iframe) in the SAFE_FOR_XML regex pattern, allowing attackers to bypass attribute sanitization. It was disclosed on March 3, 2026, with a fix committed to the repository the same day (Red Hat Advisory, Red Hat Bugzilla). The vulnerability carries a CVSS v3.1 base score of 6.1 (Medium) and a CVSS v4.0 base score of 5.3 (Medium) (Red Hat Advisory).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting). The SAFE_FOR_XML mode in DOMPurify uses a regex to detect and strip dangerous patterns from attribute values, but the regex originally only covered style and title as rawtext elements, omitting noscript, xmp, noembed, noframes, iframe, and textarea (Red Hat Bugzilla, DOMPurify Commit). An attacker can inject a closing tag for one of these unprotected rawtext elements (e.g., </noscript><img src=x onerror=alert(1)>) into an HTML attribute value; when DOMPurify sanitizes the input and the resulting output is later inserted into a page inside one of these rawtext contexts, the browser parses the injected markup and executes the JavaScript payload. Exploitation requires user interaction (a victim must visit or load the affected content) and no authentication or special privileges are needed (Red Hat Advisory). The fix expanded the SAFE_FOR_XML regex to include all missing rawtext elements, as seen in commits fca0a93 and 302b51d (DOMPurify Commit, DOMPurify Commit 2).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session, enabling session hijacking, credential theft, malware distribution, or unauthorized actions on behalf of the user. The vulnerability affects confidentiality and integrity at the system scope (changed scope in CVSS terms), meaning impact can extend beyond the vulnerable component to other browser-accessible resources. Availability is not directly impacted, but the potential for account takeover and data exfiltration makes this a meaningful risk for any application relying on DOMPurify's SAFE_FOR_XML mode to sanitize user-supplied content before rendering it in rawtext HTML contexts (Red Hat Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation (Red Hat Advisory). The EPSS score is approximately 0.029% (0.000290), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. Detection signatures have been added by Nessus (plugin IDs 300629, 315087, 315089, 315095) and Qualys, indicating scanner-level awareness of the issue.

1. Identify a vulnerable target: Locate a web application that uses DOMPurify versions 3.1.3–3.3.1 or 2.5.3–2.5.8 with the SAFE_FOR_XML option enabled, and that renders sanitized output inside rawtext HTML elements such as <noscript>, <xmp>, <noembed>, <noframes>, or <iframe>.
2. Craft a malicious payload: Construct an attribute value containing a closing rawtext tag followed by an XSS payload, for example: </noscript><img src=x onerror=alert(document.cookie)>.
3. Inject the payload: Submit the crafted string as user-supplied input to the application (e.g., via a form field, URL parameter, or stored content) that will be processed by the vulnerable DOMPurify instance.
4. Bypass sanitization: DOMPurify's SAFE_FOR_XML regex fails to detect the closing rawtext tag in the attribute value, so the payload passes through sanitization without being stripped.
5. Trigger execution: When the sanitized output is inserted into the page inside a rawtext context (e.g., inside a <noscript> block), the browser parses the injected </noscript> as closing the rawtext element, then interprets the subsequent <img onerror=...> as live HTML, executing the JavaScript payload in the victim's browser (Red Hat Bugzilla, DOMPurify Commit).

• Network: Unexpected outbound HTTP requests from user browsers to attacker-controlled domains following page loads that render DOMPurify-sanitized content; unusual POST requests exfiltrating cookies or session tokens.
• Logs: Web server or application logs showing user-submitted input containing patterns such as </noscript>, </xmp>, </noembed>, </noframes>, or </iframe> embedded within attribute values, particularly in fields processed by DOMPurify.
• Browser/Client-Side: JavaScript errors or unexpected alert() dialogs in browser console logs; Content Security Policy (CSP) violation reports triggered by inline script execution in pages using DOMPurify-sanitized content.
• File System: If stored XSS is exploited, database or file records containing payloads like </noscript><img src=x onerror=...> in user-generated content fields.

The primary remediation is to upgrade DOMPurify to version 3.3.2 or later (for the 3.x branch) or 2.5.9 or later (for the 2.x branch), which include the corrected SAFE_FOR_XML regex covering all rawtext elements (DOMPurify Release, DOMPurify Commit). As a defense-in-depth measure, implement a strict Content Security Policy (CSP) to limit the impact of any XSS that bypasses sanitization. Organizations should inventory all applications and dependencies (including transitive dependencies) that bundle DOMPurify and apply patches promptly; IBM has issued advisories for numerous affected products including Carbon Charts, Maximo Application Suite, API Connect, QRadar, Cloud Pak for Integration, and others (IBM Advisory).

IBM issued multiple security bulletins across its product portfolio acknowledging the vulnerability in components that bundle DOMPurify, including Carbon Charts, Maximo Application Suite, IBM API Connect, QRadar SIEM, Cloud Pak for Business Automation, Aspera Enterprise WebApps, and others (IBM Advisory). Red Hat tracked the issue via Bugzilla with a medium severity rating and engaged a broad set of product teams (Red Hat Bugzilla). The DOMPurify maintainer (cure53) released version 3.3.2 promptly after disclosure, crediting multiple reporters for identifying the rawtext parsing bypass (DOMPurify Release). OpenSUSE also issued a security announcement for affected packages in its ecosystem.