{"vulnerability": "CVE-2026-41238", "sightings": [{"uuid": "7bae1b85-313c-4376-9cfe-8ffa64df5b19", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-41238", "type": "published-proof-of-concept", "source": "https://t.me/thebugbountyhunter/10540", "content": "CVE-2026-41238: How Prototype Pollution Turns DOMPurify Into an XSS Gadget\n\nhttps://labs.trace37.com/blog/dompurify-pp-ceh-bypass/", "creation_timestamp": "2026-04-21T17:45:14.000000Z"}, {"uuid": "84f6b7c2-b8bc-469f-b153-4ee6a33aac43", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-41238", "type": "published-proof-of-concept", "source": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-v9jr-rg53-9pgp", "content": "", "creation_timestamp": "2026-04-20T12:41:20.000000Z"}]}