Preliminary research

CVE-2026-41238: How Prototype Pollution Turns DOMPurify Into an XSS Gadget

Paul Reed · trace37 · 20 April 2026

AI-collected research leads through 6 October 2026, including bounded month-by-month reviews of selected social and community sources from January through September. Unranked, incomplete, not community-vetted, and subject to change.

Explains a DOMPurify custom-element gadget caused by replacing normalized configuration with an ordinary fallback object. The source-level case traces inherited allowlist options and RegExp type requirements, illustrating how default allocations can undo earlier configuration hardening.

Record

Researcher

Paul Reed

Published by

trace37

Date

20 April 2026

In the archive

• Collected in the 2026 preliminary research sweep

Related sources

• Upstream advisory
• DOMPurify prototype fallback advisory
• DOMPurify evolutionary fuzzer, part 1

Tags

• prototype-pollution
• xss
• javascript
• gadget-chain
• case-study
• owasp-a03-2021
• owasp-a08-2021

This page is the archive's own catalogue record. The research is the work of Paul Reed, first published at the original source. Preserved copies are kept so the citation survives its host.