2 matches found
CVE-2026-65900
DOMPurify versions =3.0.0 and before 3.4.8, when configured with SAFEFORTEMPLATES together with a DOM output mode RETURNDOM, RETURNDOMFRAGMENT, or INPLACE, fail to strip template expressions e.g. $evil, evil, inside element content. The final normalization/scrub pass scrubTemplateExpressions uses...
6.1CVSS5.3AI score0.0031EPSS
SaveExploits1References2
CVE-2026-65900 DOMPurify before 3.4.8 Template Expression Injection via RETURN_DOM
DOMPurify versions =3.0.0 and before 3.4.8, when configured with SAFEFORTEMPLATES together with a DOM output mode RETURNDOM, RETURNDOMFRAGMENT, or INPLACE, fail to strip template expressions e.g. $evil, evil, inside element content. The final normalization/scrub pass scrubTemplateExpressions uses...
5.1CVSS5.3AI score
SaveExploits0References4
20