CVE-2026-41238: 
JavaScript vulnerability analysis and mitigation

CVE-2026-41238 is a prototype pollution-to-XSS bypass vulnerability in DOMPurify, a widely used DOM-based HTML sanitization library. Affecting versions 3.0.1 through 3.3.3, the flaw allows an attacker who has already achieved prototype pollution in the same JavaScript execution context to bypass DOMPurify's sanitization entirely, enabling arbitrary XSS payloads to survive the sanitization process. The vulnerability was discovered on April 4, 2026, during automated fuzzing research (the "Fermat project") by trace37labs, with responsible disclosure initiated the same day; the advisory was published April 20–22, 2026. It carries a CVSS v3.1 base score of 6.9 (Medium) (GitHub Advisory).

The root cause lies in purify.js at line 590, where the config parsing fallback CUSTOM_ELEMENT_HANDLING = cfg.CUSTOM_ELEMENT_HANDLING || {}; creates a plain object that inherits from Object.prototype. When no CUSTOM_ELEMENT_HANDLING option is provided (the default usage), the conditional blocks that would explicitly set tagNameCheck and attributeNameCheck are never entered, so these properties resolve via the prototype chain. If an attacker has previously polluted Object.prototype.tagNameCheck and Object.prototype.attributeNameCheck with permissive regex values (e.g., /.*/), DOMPurify's custom element and attribute validation at lines 973–977 will allow all custom elements and all attributes — including event handlers — through sanitization. The vulnerability is classified as CWE-79 (Cross-site Scripting) and CWE-1321 (Prototype Pollution), and is distinct from prior DOMPurify issues GHSA-cj63-jhhr-wcxv and CVE-2024-45801. The vulnerable || {} reassignment was introduced in the 3.0.0→3.0.1 refactor; DOMPurify 3.0.0 and all 2.x versions are not affected (GitHub Advisory, DOMPurify Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the victim's browser context, bypassing DOMPurify's sanitization entirely. The primary impact is high confidentiality loss — attackers can steal session cookies, authentication tokens, and other sensitive data via injected event handlers — with a low integrity impact through page content manipulation. Because the scope is changed (XSS can access cross-origin resources via cookies and session tokens), the vulnerability affects not just the vulnerable application but potentially other origins accessible to the victim. Downstream IBM products incorporating vulnerable DOMPurify versions are also affected, including IBM App Connect Enterprise, IBM API Connect, IBM Maximo Application Suite, IBM QRadar SIEM, IBM Aspera Enterprise WebApps, Carbon Charts, Carbon AI Chat, and IBM Cloud Pak for Integration (GitHub Advisory, IBM Advisory).

A public proof-of-concept is included in the official advisory, demonstrating the full exploit chain with a simple JavaScript snippet. Exploitation requires a prerequisite prototype pollution primitive in the same execution context — a condition that is practically common given the prevalence of PP gadgets in JavaScript ecosystems (lodash, jQuery.extend, qs, deep-extend, merge-deep, etc.). No in-the-wild exploitation has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.033–0.039% (12th percentile), reflecting low but non-zero exploitation probability in the near term (GitHub Advisory).

1. Identify a prototype pollution gadget: Locate a prototype pollution vulnerability in the target application's JavaScript dependencies (e.g., a vulnerable version of lodash's _.merge, jQuery's $.extend, the qs query-string parser, or any deep-merge utility) that allows writing arbitrary properties to Object.prototype.

2. Pollute Object.prototype: Exploit the identified gadget to inject permissive regex values:

Object.prototype.tagNameCheck = /.*/;
Object.prototype.attributeNameCheck = /.*/;

3. Craft a malicious HTML payload: Construct an HTML payload using a custom element (tag name containing a hyphen) with an event handler attribute:

<x-x onfocus=alert(document.cookie) tabindex=0 autofocus>

4. Submit payload for sanitization: Deliver the payload to the application in any user-controlled input field that is processed by DOMPurify.sanitize() with default configuration (no explicit CUSTOM_ELEMENT_HANDLING).

5. Bypass sanitization: Due to the polluted prototype, DOMPurify's CUSTOM_ELEMENT_HANDLING.tagNameCheck and attributeNameCheck resolve to /.*/, causing the custom element and its event handler to pass validation and appear in the sanitized output.

6. Trigger XSS: When the application injects the "sanitized" output into the DOM (e.g., element.innerHTML = clean), the event handler fires — for example, on autofocus — executing arbitrary JavaScript in the victim's browser and enabling session hijacking or data exfiltration (GitHub Advisory, DOMPurify Advisory).

• Network: Unusual HTTP requests containing hyphenated custom HTML element tags (e.g., <x-x, <my-element) with event handler attributes (onfocus, onmouseover, onerror) in POST body or query parameters submitted to input fields.
• Network: Outbound requests from the victim's browser to attacker-controlled domains (e.g., for cookie exfiltration via fetch() or XMLHttpRequest) following interaction with a page containing sanitized content.
• Logs: Application logs showing user-submitted input containing patterns like Object.prototype, __proto__, or constructor.prototype in JSON payloads or query strings — indicative of prototype pollution attempts.
• Logs: Browser console errors or unexpected JavaScript execution traces in client-side logging frameworks, particularly involving custom element rendering.
• File System / Code: Presence of DOMPurify npm package versions 3.0.1–3.3.3 in package.json or package-lock.json (node_modules/dompurify/package.json showing "version": "3.x.x" where x < 4.0.0).

Primary fix: Upgrade DOMPurify to version 3.4.0, which resolves the issue by replacing the vulnerable || {} fallback with create(null) (a prototype-less object), preventing prototype chain inheritance (DOMPurify 3.4.0).

Application-level workaround (if immediate upgrade is not possible): Always pass an explicit CUSTOM_ELEMENT_HANDLING object in the sanitize call:

DOMPurify.sanitize(input, {
  CUSTOM_ELEMENT_HANDLING: {
    tagNameCheck: null,
    attributeNameCheck: null
  }
});

This triggers the explicit configuration path in DOMPurify, bypassing the vulnerable prototype chain lookup.

Additional hardening: Audit and remediate any prototype pollution gadgets in the application's JavaScript dependency tree (lodash, jQuery, qs, deep-extend, etc.) to eliminate the prerequisite for this attack chain. IBM product users should apply the relevant IBM security bulletins for App Connect Enterprise, API Connect, Maximo Application Suite, QRadar SIEM, Aspera Enterprise WebApps, and Cloud Pak for Integration (IBM Advisory).

The vulnerability was discovered and responsibly disclosed by trace37labs as part of their automated "Fermat project" fuzzing research, and credited in the official DOMPurify 3.4.0 release notes (DOMPurify 3.4.0). A detailed technical blog post was published by trace37labs at labs.trace37.com/blog/dompurify-pp-ceh-bypass, providing additional analysis of the prototype pollution chain. IBM issued multiple security bulletins across its product portfolio acknowledging the vulnerability's impact on downstream products including Carbon Charts, AI Chat components, API Connect, Maximo, QRadar, and Aspera (IBM Advisory). Community coverage appeared on VulDB, CIRCL, and security aggregators shortly after the advisory was published, and a video walkthrough titled "XSSocalypse 2026" was published on undercodetesting.com discussing the broader implications of the bypass.