CVE-2026-65900 DOMPurify before 3.4.8 Template Expression Injection via RETURN_DOM

🗓️ 23 Jul 2026 13:16:19Reported by VulnCheckType

CVE-2026-65900: DOMPurify with SAFE_FOR_TEMPLATES and RETURN_DOM fails to scrub template expressions in template content.

Reporter	Title	Published	Views	Family All 31
IBM Security Bulletins	Security Bulletin: IBM Security QRadar Log Management AQL Plugin is vulnerable to using components with known vulnerabilities	10 Aug 202614:18	–	ibm
IBM Security Bulletins	Security Bulletin: Resolved multiple XSS vulnerabilities in DOMPurify (CVE-2026-49978, CVE-2026-65898, CVE-2026-66010, and others)	7 Aug 202609:26	–	ibm
IBM Security Bulletins	Security Bulletin: Resolved multiple XSS vulnerabilities in DOMPurify (CVE-2026-49978, CVE-2026-65898, CVE-2026-66010, and others)	7 Aug 202609:29	–	ibm
ATTACKERKB	CVE-2026-65900	23 Jul 202613:16	–	attackerkb
Chainguard	CVE-2026-65900 vulnerabilities	24 Jul 202620:25	–	cgr
Circl	CVE-2026-65900	23 Jul 202616:35	–	circl
CVE	CVE-2026-65900	23 Jul 202613:16	–	cve
Debian CVE	CVE-2026-65900	23 Jul 202613:16	–	debiancve
EUVD	EUVD-2026-48269	23 Jul 202613:16	–	euvd
Github Security Blog	DOMPurify: SAFE_FOR_TEMPLATES bypass - template expressions survive sanitization inside <template> content when using DOM output modes	15 Jun 202620:02	–	github

[
  {
    "vendor": "cure53",
    "product": "DOMPurify",
    "defaultStatus": "unaffected",
    "packageURL": "pkg:npm/dompurify",
    "versions": [
      {
        "version": "3.0.0",
        "status": "affected",
        "versionType": "semver",
        "lessThan": "3.4.8"
      },
      {
        "version": "3.4.8",
        "status": "unaffected",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
vulncheck	www.vulncheck.com/advisories/dompurify-before-template-expression-injection-via-return-dom
github	www.github.com/cure53/DOMPurify/security/advisories/GHSA-gvmj-g25r-r7wr

23 Jul 2026 13:16Current

CVSS 45.1

CVSS 3.16.1

EPSS0.0018

CWE-79