CVE-2026-65900 in DOMPurify
Summary
by MITRE • 07/23/2026
DOMPurify versions >=3.0.0 and before 3.4.8, when configured with SAFE_FOR_TEMPLATES together with a DOM output mode (RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE), fail to strip template expressions (e.g. ${evil}, {{evil}}, <%evil%>) inside <template> element content. The final normalization/scrub pass (_scrubTemplateExpressions) uses a NodeIterator and node.normalize() that do not descend into template.content, so expressions that only form after adjacent text nodes merge survive sanitization. This bypasses SAFE_FOR_TEMPLATES and can allow a downstream template engine to evaluate attacker-supplied expressions. The string output path is not affected.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/23/2026
The vulnerability in DOMPurify affects versions 3.0.0 through 3.4.7 when specific configuration parameters are used, creating a critical security gap in HTML sanitization processes. This flaw specifically impacts applications that utilize the SAFE_FOR_TEMPLATES configuration alongside DOM output modes such as RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE. The vulnerability stems from an insufficient sanitization approach within the _scrubTemplateExpressions function that relies on NodeIterator and node.normalize() methods which fail to properly traverse into template.content nodes. This technical oversight creates a pathway for attackers to bypass intended security measures by embedding malicious template expressions like ${evil}, {{evil}}, or <%evil%> within template element content.
The operational impact of this vulnerability extends beyond simple XSS attacks, as it allows for template injection attacks that can compromise applications using downstream template engines. When adjacent text nodes merge during the normalization process, template expressions that exist only after this merging process survive the sanitization checks and can be executed by template processing systems. This creates a dangerous scenario where sanitized content appears safe but contains executable payloads that bypass security controls. The vulnerability is particularly concerning because it affects DOM-based output modes while leaving string output paths unaffected, creating inconsistent security boundaries within the same library.
Security researchers have identified this issue as mapping to CWE-1021, which describes improper neutralization of special elements used in template expressions. The ATT&CK framework categorizes this as a code injection technique where adversaries leverage template engine vulnerabilities to execute malicious code. Organizations using DOMPurify with the affected configurations face potential exploitation through server-side template injection or client-side template execution attacks that can lead to data exfiltration, privilege escalation, or complete system compromise. The vulnerability demonstrates how seemingly minor implementation details in sanitization algorithms can create significant security weaknesses.
The recommended mitigations include upgrading to DOMPurify version 3.4.8 or later where the _scrubTemplateExpressions function has been properly enhanced to handle template.content traversal. Administrators should also review their application configurations to avoid using SAFE_FOR_TEMPLATES with DOM output modes when possible, or implement additional layers of security validation. Security teams must conduct thorough code audits to identify any applications that might be vulnerable and ensure proper patch management processes are in place. The fix addresses the core issue by ensuring proper node traversal during the sanitization process, preventing template expressions from surviving normalization passes that occur after text node merging operations.