CVE-2026-0540
Medium · 6.1CVSS
6.1
EPSS
0.4%
Published
Mar 3, 2026
CISA due date
—
The record
DOMPurify 3.1.3 through 3.3.1 and 2.5.3 through 2.5.8, fixed in commit 2726c74, contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting five missing rawtext elements (noscript, xmp, noembed, noframes, iframe) in the SAFE_FOR_XML regex. Attackers can include payloads like </noscript><img src=x onerror=alert(1)> in attribute values to execute JavaScript when sanitized output is placed inside these unprotected rawtext contexts.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | dompurify | 2.5.3 | 2.5.9 |
| npm | dompurify | 3.1.3 | 3.3.2 |
| Chainguard | kibana-8.19 | 0 | 8.19.13-r0 |
| Chainguard | kibana-8.19-bitnami | 0 | 8.19.13-r0 |
| Chainguard | kibana-8.19-iamguarded | 0 | 8.19.13-r0 |
| Chainguard | kibana-9.1 | 0 | 9.1.10-r7 |
| Chainguard | kibana-9.1-iamguarded | 0 | 9.1.10-r7 |
| Chainguard | kibana-9.2 | 0 | 9.2.6-r2 |
| Chainguard | kibana-9.2-iamguarded | 0 | 9.2.6-r2 |
| Chainguard | kibana-9.3 | 0 | 9.3.1-r1 |
| Chainguard | kibana-9.3-iamguarded | 0 | 9.3.1-r1 |
| Chainguard | langfuse-2 | 0 | 2.95.12-r13 |
| Chainguard | langfuse-2-worker | 0 | 2.95.12-r13 |
| Chainguard | langfuse-3 | 0 | 3.160.0-r1 |
| Chainguard | langfuse-3-worker | 0 | 3.160.0-r1 |
| Chainguard | langfuse-fips-2 | 0 | 2.95.12-r16 |
| Chainguard | langfuse-fips-2-worker | 0 | 2.95.12-r16 |
| Chainguard | langfuse-fips-3 | 0 | 3.160.0-r1 |
| Chainguard | langfuse-fips-3-worker | 0 | 3.160.0-r1 |
| Chainguard | librechat | 0 | 0.8.3-r0 |
| Chainguard | opensearch-dashboards-2 | 0 | 2.19.5-r3 |
| Chainguard | opensearch-dashboards-2-alerting-dashboards-plugin | 0 | 2.19.4-r14 |
| Chainguard | opensearch-dashboards-2-anomaly-detection-dashboards-plugin | 0 | 2.19.4-r14 |
| Chainguard | opensearch-dashboards-2-dashboards-maps | 0 | 2.19.4-r14 |
| Chainguard | opensearch-dashboards-2-dashboards-notifications | 0 | 2.19.4-r14 |
| Chainguard | opensearch-dashboards-2-dashboards-observability | 0 | 2.19.4-r14 |
| Chainguard | opensearch-dashboards-2-dashboards-query-workbench | 0 | 2.19.4-r14 |
| Chainguard | opensearch-dashboards-2-dashboards-reporting | 0 | 2.19.5-r3 |
| Chainguard | opensearch-dashboards-2-dashboards-search-relevance | 0 | 2.19.4-r14 |
| Chainguard | opensearch-dashboards-2-dashboards-visualizations | 0 | 2.19.4-r14 |
| Chainguard | opensearch-dashboards-2-fips | 0 | 2.19.5-r1 |
| Chainguard | opensearch-dashboards-2-fips-alerting-dashboards-plugin | 0 | 2.19.4-r14 |
| Chainguard | opensearch-dashboards-2-fips-anomaly-detection-dashboards-plugin | 0 | 2.19.4-r14 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-maps | 0 | 2.19.4-r14 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-notifications | 0 | 2.19.4-r14 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-observability | 0 | 2.19.4-r14 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-query-workbench | 0 | 2.19.4-r14 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-reporting | 0 | 2.19.5-r1 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-search-relevance | 0 | 2.19.4-r14 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-visualizations | 0 | 2.19.4-r14 |
| Chainguard | opensearch-dashboards-2-fips-index-management-dashboards-plugin | 0 | 2.19.4-r14 |
| Chainguard | opensearch-dashboards-2-fips-ml-commons-dashboards | 0 | 2.19.4-r14 |
| Chainguard | opensearch-dashboards-2-fips-security-analytics-dashboards-plugin | 0 | 2.19.4-r14 |
| Chainguard | opensearch-dashboards-2-fips-security-dashboards-plugin | 0 | 2.19.4-r14 |
| Chainguard | opensearch-dashboards-2-index-management-dashboards-plugin | 0 | 2.19.4-r14 |
| Chainguard | opensearch-dashboards-2-ml-commons-dashboards | 0 | 2.19.4-r14 |
| Chainguard | opensearch-dashboards-2-security-analytics-dashboards-plugin | 0 | 2.19.4-r14 |
| Chainguard | opensearch-dashboards-2-security-dashboards-plugin | 0 | 2.19.4-r14 |
| Chainguard | opensearch-dashboards-3 | 0 | 3.5.0-r6 |
| Chainguard | opensearch-dashboards-3-alerting-dashboards-plugin | 0 | 3.5.0-r6 |
| Chainguard | opensearch-dashboards-3-anomaly-detection-dashboards-plugin | 0 | 3.5.0-r6 |
| Chainguard | opensearch-dashboards-3-dashboards-maps | 0 | 3.5.0-r6 |
| Chainguard | opensearch-dashboards-3-dashboards-notifications | 0 | 3.5.0-r6 |
| Chainguard | opensearch-dashboards-3-dashboards-observability | 0 | 3.5.0-r6 |
| Chainguard | opensearch-dashboards-3-dashboards-query-workbench | 0 | 3.5.0-r6 |
| Chainguard | opensearch-dashboards-3-dashboards-reporting | 0 | 3.5.0-r6 |
| Chainguard | opensearch-dashboards-3-dashboards-search-relevance | 0 | 3.5.0-r6 |
| Chainguard | opensearch-dashboards-3-fips | 0 | 3.5.0-r6 |
| Chainguard | opensearch-dashboards-3-fips-alerting-dashboards-plugin | 0 | 3.5.0-r4 |
| Chainguard | opensearch-dashboards-3-fips-anomaly-detection-dashboards-plugin | 0 | 3.5.0-r4 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-maps | 0 | 3.5.0-r4 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-notifications | 0 | 3.5.0-r4 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-observability | 0 | 3.5.0-r6 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-query-workbench | 0 | 3.5.0-r4 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-reporting | 0 | 3.5.0-r6 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-search-relevance | 0 | 3.5.0-r4 |
| Chainguard | opensearch-dashboards-3-fips-index-management-dashboards-plugin | 0 | 3.5.0-r4 |
| Chainguard | opensearch-dashboards-3-fips-ml-commons-dashboards | 0 | 3.5.0-r4 |
| Chainguard | opensearch-dashboards-3-fips-security-analytics-dashboards-plugin | 0 | 3.5.0-r4 |
| Chainguard | opensearch-dashboards-3-fips-security-dashboards-plugin | 0 | 3.5.0-r4 |
| Chainguard | opensearch-dashboards-3-index-management-dashboards-plugin | 0 | 3.5.0-r6 |
| Chainguard | opensearch-dashboards-3-ml-commons-dashboards | 0 | 3.5.0-r6 |
| Chainguard | opensearch-dashboards-3-security-analytics-dashboards-plugin | 0 | 3.5.0-r6 |
| Chainguard | opensearch-dashboards-3-security-dashboards-plugin | 0 | 3.5.0-r6 |
| Chainguard | wazuh-dashboard-plugins | 0 | 4.14.4-r1 |
| Wolfi | langfuse-3 | 0 | 3.160.0-r1 |
| Wolfi | langfuse-3-worker | 0 | 3.160.0-r1 |
| Wolfi | opensearch-dashboards-2 | 0 | 2.19.5-r3 |
| Wolfi | opensearch-dashboards-2-alerting-dashboards-plugin | 0 | 2.19.4-r14 |
| Wolfi | opensearch-dashboards-2-anomaly-detection-dashboards-plugin | 0 | 2.19.4-r14 |
| Wolfi | opensearch-dashboards-2-dashboards-maps | 0 | 2.19.4-r14 |
| Wolfi | opensearch-dashboards-2-dashboards-notifications | 0 | 2.19.4-r14 |
| Wolfi | opensearch-dashboards-2-dashboards-observability | 0 | 2.19.4-r14 |
| Wolfi | opensearch-dashboards-2-dashboards-query-workbench | 0 | 2.19.4-r14 |
| Wolfi | opensearch-dashboards-2-dashboards-reporting | 0 | 2.19.5-r3 |
| Wolfi | opensearch-dashboards-2-dashboards-search-relevance | 0 | 2.19.4-r14 |
| Wolfi | opensearch-dashboards-2-dashboards-visualizations | 0 | 2.19.4-r14 |
| Wolfi | opensearch-dashboards-2-index-management-dashboards-plugin | 0 | 2.19.4-r14 |
| Wolfi | opensearch-dashboards-2-ml-commons-dashboards | 0 | 2.19.4-r14 |
| Wolfi | opensearch-dashboards-2-security-analytics-dashboards-plugin | 0 | 2.19.4-r14 |
| Wolfi | opensearch-dashboards-2-security-dashboards-plugin | 0 | 2.19.4-r14 |
| Wolfi | opensearch-dashboards-3 | 0 | 3.5.0-r6 |
| Wolfi | opensearch-dashboards-3-alerting-dashboards-plugin | 0 | 3.5.0-r6 |
| Wolfi | opensearch-dashboards-3-anomaly-detection-dashboards-plugin | 0 | 3.5.0-r6 |
| Wolfi | opensearch-dashboards-3-dashboards-maps | 0 | 3.5.0-r6 |
| Wolfi | opensearch-dashboards-3-dashboards-notifications | 0 | 3.5.0-r6 |
| Wolfi | opensearch-dashboards-3-dashboards-observability | 0 | 3.5.0-r6 |
| Wolfi | opensearch-dashboards-3-dashboards-query-workbench | 0 | 3.5.0-r6 |
| Wolfi | opensearch-dashboards-3-dashboards-reporting | 0 | 3.5.0-r6 |
| Wolfi | opensearch-dashboards-3-dashboards-search-relevance | 0 | 3.5.0-r6 |
| Wolfi | opensearch-dashboards-3-index-management-dashboards-plugin | 0 | 3.5.0-r6 |
| Wolfi | opensearch-dashboards-3-ml-commons-dashboards | 0 | 3.5.0-r6 |
| Wolfi | opensearch-dashboards-3-security-analytics-dashboards-plugin | 0 | 3.5.0-r6 |
| Wolfi | opensearch-dashboards-3-security-dashboards-plugin | 0 | 3.5.0-r6 |
| openSUSE:Tumbleweed | cacti | 0 | 1.2.30+git306.82d5aef5-1.1 |
Related vulnerabilities
- GHSA-v2wj-7wpq-c8vv DOMPurify contains a Cross-site Scripting vulnerability Same vulnerability
- GHSA-cmwh-pvxp-8882 DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook… Also affects dompurify
- GHSA-vxr8-fq34-vvx9 DOMPurify: Trusted Types policy survives `clearConfig()` and can poison later… Also affects dompurify
- GHSA-gvmj-g25r-r7wr DOMPurify: SAFE_FOR_TEMPLATES bypass - template expressions survive sanitization inside… Also affects dompurify
- GHSA-rp9w-3fw7-7cwq DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside .content Also affects dompurify
- GHSA-x4vx-rjvf-j5p4 DOMPurify: `IN_PLACE` mode trusts attacker-controlled `nodeName` on live non-form nodes… Also affects dompurify
- GHSA-76mc-f452-cxcm DOMPurify: Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently… Also affects dompurify
- GHSA-hpcv-96wg-7vj8 DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via… Also affects dompurify