CVE-2026-41239

medium Red Hat
CVSS v3 Base Score
6.8
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
EPSS Score
0.1%
Exploitation probability in 30 days
Top 81% most likely to be exploited
Attack Characteristics
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
Required
Confidentiality
High
Integrity
High
Availability
None
Published: April 23, 2026 (77 days ago)
Last Modified: April 23, 2026
Vendor: Red Hat
Source: REDHAT

Description

A flaw was found in DOMPurify. A remote attacker could exploit this cross-site scripting (XSS) vulnerability when DOMPurify is configured to return a Document Object Model (DOM) or DOM fragment. The SAFE_FOR_TEMPLATES feature, intended to strip template expressions like {{...}}, fails in these modes, allowing malicious content to bypass sanitization. This can lead to arbitrary code execution or information disclosure in applications utilizing template-evaluating frameworks such as Vue 2.

CWE

CWE-1289

Affected Products

Cryostat 4Migration Toolkit for VirtualizationMulticluster Engine for KubernetesNode HealthCheck OperatorOpenShift LightspeedOpenShift Service Mesh 2OpenShift Service Mesh 3Red Hat 3scale API Management Platform 2Red Hat Advanced Cluster Security 4Red Hat Ansible Automation Platform 2

References

🔗 bugzilla.redhat.com 🔗 www.cve.org 🔗 nvd.nist.gov 🔗 github.com 🔗 github.com