{"vulnerability": "cve-2026-41238", "sightings": [{"uuid": "7bae1b85-313c-4376-9cfe-8ffa64df5b19", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2026-41238", "type": "published-proof-of-concept", "source": "https://t.me/thebugbountyhunter/10540", "content": "CVE-2026-41238: How Prototype Pollution Turns DOMPurify Into an XSS Gadget\n\nhttps://labs.trace37.com/blog/dompurify-pp-ceh-bypass/", "creation_timestamp": "2026-04-21T17:45:14.000000Z"}, {"uuid": "84f6b7c2-b8bc-469f-b153-4ee6a33aac43", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "4f29edb9-4c4b-44ca-b041-9b050656b6ae", "vulnerability": "CVE-2026-41238", "type": "published-proof-of-concept", "source": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-v9jr-rg53-9pgp", "content": "", "creation_timestamp": "2026-04-20T12:41:20.000000Z"}]}