CVE-2026-65900: DOMPurify before 3.4.8 Template Expression Injection via RETURN_DOM
DOMPurify versions >=3.0.0 and before 3.4.8, when configured with SAFEFORTEMPLATES together with a DOM output mode (RETURNDOM, RETURNDOMFRAGMENT, or INPLACE), fail to strip template expressions (e.g. ${evil}, {{evil}}, <%evil%>) inside <template> element content. The final normalization/scrub pass (scrubTemplateExpressions) uses a NodeIterator and node.normalize() that do not descend into template.content, so expressions that only form after adjacent text nodes merge survive sanitization. This bypasses SAFEFORTEMPLATES and can allow a downstream template engine to evaluate attacker-supplied expressions. The string output path is not affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
DOMPurifyto a version that resolves this vulnerability.Fixed in 3.4.8 - Configuration
Avoid using DOMPurify versions >=3.0.0 and before 3.4.8 with SAFE_FOR_TEMPLATES together with DOM output modes RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE, because template expressions inside <template> element content can survive sanitization via Template Expression Injection via RETURN_DOM.
DOMPurify SAFE_FOR_TEMPLATES + output mode (RETURN_DOM / RETURN_DOM_FRAGMENT / IN_PLACE) = disable combination (use a DOM output mode without SAFE_FOR_TEMPLATES, or keep SAFE_FOR_TEMPLATES without DOM output modes)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-65900?
CVE-2026-65900 has a medium severity rating of 6.1.
How do I fix CVE-2026-65900?
To address CVE-2026-65900, upgrade DOMPurify to version 3.4.8 or later.
What types of vulnerabilities does CVE-2026-65900 affect?
CVE-2026-65900 specifically affects applications using DOMPurify for sanitizing template expressions.
What impact does CVE-2026-65900 have on web applications?
CVE-2026-65900 can lead to template expression injection, potentially allowing Cross-Site Scripting (XSS) attacks.
In which versions is CVE-2026-65900 present?
CVE-2026-65900 is present in DOMPurify versions 3.0.0 to 3.4.7.