npm: DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes

npm: DOMPurify SAFEFORTEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes vulnerability discovered by ? in WordPress npm dompurify versions = 3.4.4, = 3.4.16...

BIT-GOLANG-2026-94448 Reset context tracking on consecutive template expressions in html/template

When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression. We now ensure that template-literal expression entries correctly reset context variables so all subsequent regular expression literals are...

CVE-2026-104126

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17-lts, JumpServer's Ansible-based automation rendering can evaluate attacker-controlled template expressions from users who have permission to create or execute affected automation...

PT-2026-111680

Name of the Vulnerable Software and Affected Versions JumpServer versions prior to 4.10.17-lts Description Ansible-based automation rendering allows the evaluation of attacker-controlled template expressions by users with permissions to create or execute affected automation tasks. This can trigge...

CVE-2026-94448

A vulnerability exists in the JavaScript engine where context tracking states are not properly reset when a template literal contains consecutive expressions. This flaw prevents subsequent regular expression literals from being accurately recognized and escaped. The issue is addressed by ensuring...

PT-2026-104404

Name of the Vulnerable Software and Affected Versions fsspec versions 0.9.0 through 2026.6.0 Description The fsspec.implementations.reference.ReferenceFileSystem evaluates fields from Kerchunk reference JSON documents using unrestricted jinja2.Template....render... calls within the process...

CVE-2026-73505

Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, the setStyle function in src/segments/path.go passed pt.Path, which includes raw folder names, to template.Render, whose function map exposes cmd, so an attacker-controlled directory name...

CVE-2026-72911: Improper Neutralization of Special Elements Used in a Template Engine

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.29.0, the validatetemplate and rendertemplate calls in erpnext/accounts/doctype/processstatementofaccounts/processstatementofaccounts.py render subject, body, and pdfname fields with unrestricted globals...

EUVD-2026-54259

CTI-Transmute contains a stored cross-site scripting vulnerability caused by insufficient neutralization of Vue template expression delimiters in server-rendered user-controlled data. An unauthenticated attacker can create a public conversion whose name or description contains a malicious Vue...

SUSE CVE-2026-65900

DOMPurify versions =3.0.0 and before 3.4.8, when configured with SAFEFORTEMPLATES together with a DOM output mode RETURNDOM, RETURNDOMFRAGMENT, or INPLACE, fail to strip template expressions e.g. $evil, evil, inside element content. The final normalization/scrub pass scrubTemplateExpressions uses...

Linux Distros Unpatched Vulnerability : CVE-2026-65900

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - DOMPurify versions =3.0.0 and before 3.4.8, when configured with SAFEFORTEMPLATES together with a DOM output mode RETURNDOM, RETURNDOMFRAGMENT, or INPLACE, fail...

CVE-2026-65900

DOMPurify versions =3.0.0 and before 3.4.8, when configured with SAFEFORTEMPLATES together with a DOM output mode RETURNDOM, RETURNDOMFRAGMENT, or INPLACE, fail to strip template expressions e.g. $evil, evil, inside element content. The final normalization/scrub pass scrubTemplateExpressions uses...

CVE-2026-65900

DOMPurify versions =3.0.0 and before 3.4.8, when configured with SAFEFORTEMPLATES together with a DOM output mode RETURNDOM, RETURNDOMFRAGMENT, or INPLACE, fail to strip template expressions e.g. $evil, evil, inside element content. The final normalization/scrub pass scrubTemplateExpressions uses...

CVE-2026-65900 DOMPurify before 3.4.8 Template Expression Injection via RETURN_DOM

DOMPurify versions =3.0.0 and before 3.4.8, when configured with SAFEFORTEMPLATES together with a DOM output mode RETURNDOM, RETURNDOMFRAGMENT, or INPLACE, fail to strip template expressions e.g. $evil, evil, inside element content. The final normalization/scrub pass scrubTemplateExpressions uses...

CVE-2026-65900

DOMPurify versions =3.0.0 and before 3.4.8, when configured with SAFEFORTEMPLATES together with a DOM output mode RETURNDOM, RETURNDOMFRAGMENT, or INPLACE, fail to strip template expressions e.g. $evil, evil, inside element content. The final normalization/scrub pass scrubTemplateExpressions uses...

EUVD-2026-48269

DOMPurify versions =3.0.0 and before 3.4.8, when configured with SAFEFORTEMPLATES together with a DOM output mode RETURNDOM, RETURNDOMFRAGMENT, or INPLACE, fail to strip template expressions e.g. $evil, evil, inside element content. The final normalization/scrub pass scrubTemplateExpressions uses...

CVE-2026-65900 DOMPurify before 3.4.8 Template Expression Injection via RETURN_DOM

DOMPurify versions =3.0.0 and before 3.4.8, when configured with SAFEFORTEMPLATES together with a DOM output mode RETURNDOM, RETURNDOMFRAGMENT, or INPLACE, fail to strip template expressions e.g. $evil, evil, inside element content. The final normalization/scrub pass scrubTemplateExpressions uses...

CVE-2026-65900

CVE-2026-65900 affects DOMPurify versions 3.0.0 up to 3.4.7 when configured with SAFE_FOR_TEMPLATES and a DOM output mode (RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE). The final scrub pass (_scrubTemplateExpressions) uses a NodeIterator and node.normalize() that do not descend into template.con...

CVE-2026-65900 DOMPurify before 3.4.8 Template Expression Injection via RETURN_DOM

DOMPurify versions =3.0.0 and before 3.4.8, when configured with SAFEFORTEMPLATES together with a DOM output mode RETURNDOM, RETURNDOMFRAGMENT, or INPLACE, fail to strip template expressions e.g. $evil, evil, inside element content. The final normalization/scrub pass scrubTemplateExpressions uses...

Improper Neutralization Of Template Expressions

DOMPurify is vulnerable to improper neutralization of template expressions. The vulnerability is due to improper sanitization when both SAFEFORTEMPLATES: true and RETURNDOM: true or INPLACE: true are enabled, which allows an attacker to inject template expressions e.g., $evil, evil, or that remai...