CVE-2026-65900

A flaw was found in DOMPurify. When configured to sanitize HTML templates for direct Document Object Model DOM output, the software fails to properly remove malicious template expressions. This allows an attacker to inject specially crafted input that bypasses the sanitization process...

CVE-2026-65900

DOMPurify versions =3.0.0 and before 3.4.8, when configured with SAFEFORTEMPLATES together with a DOM output mode RETURNDOM, RETURNDOMFRAGMENT, or INPLACE, fail to strip template expressions e.g. $evil, evil, inside element content. The final normalization/scrub pass scrubTemplateExpressions uses...

CVE-2026-65900

CVE-2026-65900 affects DOMPurify versions 3.0.0 up to 3.4.7 when configured with SAFE_FOR_TEMPLATES and a DOM output mode (RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE). The final scrub pass (_scrubTemplateExpressions) uses a NodeIterator and node.normalize() that do not descend into template.con...

CVE-2026-65900 DOMPurify before 3.4.8 Template Expression Injection via RETURN_DOM

DOMPurify versions =3.0.0 and before 3.4.8, when configured with SAFEFORTEMPLATES together with a DOM output mode RETURNDOM, RETURNDOMFRAGMENT, or INPLACE, fail to strip template expressions e.g. $evil, evil, inside element content. The final normalization/scrub pass scrubTemplateExpressions uses...

PT-2026-63986

Name of the Vulnerable Software and Affected Versions DOMPurify versions 3.0.0 through 3.4.7 Description When configured with SAFE FOR TEMPLATES and a DOM output mode RETURN DOM, RETURN DOM FRAGMENT, or IN PLACE, the software fails to strip template expressions such as $evil, evil, or within...