CVE-2026-65900

CVE-2026-65900 affects DOMPurify versions 3.0.0 up to 3.4.7 when configured with SAFE_FOR_TEMPLATES and a DOM output mode (RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE). The final scrub pass (_scrubTemplateExpressions) uses a NodeIterator and node.normalize() that do not descend into template.con...

PT-2026-63986

DOMPurify versions =3.0.0 and before 3.4.8, when configured with SAFE FOR TEMPLATES together with a DOM output mode RETURN DOM, RETURN DOM FRAGMENT, or IN PLACE, fail to strip template expressions e.g. $evil, evil, inside element content. The final normalization/scrub pass scrubTemplateExpression...