CVE-2026-65900 Details
Description
DOMPurify versions >=3.0.0 and before 3.4.8, when configured with SAFE_FOR_TEMPLATES together with a DOM output mode (RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE), fail to strip template expressions (e.g. ${evil}, {{evil}}, <%evil%>) inside <template> element content. The final normalization/scrub pass (_scrubTemplateExpressions) uses a NodeIterator and node.normalize() that do not descend into template.content, so expressions that only form after adjacent text nodes merge survive sanitization. This bypasses SAFE_FOR_TEMPLATES and can allow a downstream template engine to evaluate attacker-supplied expressions. The string output path is not affected.
A vulnerability exists in DOMPurify versions 3.0.0 prior to 3.4.8. When the library is used with the SAFE_FOR_TEMPLATES option enabled, along with a DOM output mode (RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE), it fails to properly sanitize template expressions within <template> element content. The issue arises because the final sanitization pass does not traverse into the template's content, allowing expressions that form after text nodes merge to survive. This bypasses the intended protection of SAFE_FOR_TEMPLATES, potentially enabling a downstream template engine to evaluate malicious expressions. Notably, the vulnerability does not affect the string output path.
Users can upgrade to DOMPurify version 3.4.8 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/cure53/DOMPurify/security/advisories/GHSA-gvmj-g25r-r7wr | CISA-ADP | ExploitThird Party Advisory |
| https://github.com/cure53/DOMPurify/security/advisories/GHSA-gvmj-g25r-r7wr | [email protected] | ExploitThird Party Advisory |
| https://www.vulncheck.com/advisories/dompurify-before-template-expression-injection-via-return-dom | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| cure53 dompurify | >= 3.0.0, < 3.4.8 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 28, 2026 | Initial Analysis | [email protected] |
| Jul 23, 2026 | CVE Modified | CISA-ADP |
| Jul 23, 2026 | New CVE Received | [email protected] |