CVE-2026-65900
Undergoing Analysis Undergoing Analysis - In Progress

DOM Clobbering via Template Expressions in DOMPurify

Publication date: 2026-07-23

Last updated on: 2026-07-23

Assigner: VulnCheck

Description
DOMPurify versions >=3.0.0 and before 3.4.8, when configured with SAFE_FOR_TEMPLATES together with a DOM output mode (RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE), fail to strip template expressions (e.g. ${evil}, {{evil}}, <%evil%>) inside <template> element content. The final normalization/scrub pass (_scrubTemplateExpressions) uses a NodeIterator and node.normalize() that do not descend into template.content, so expressions that only form after adjacent text nodes merge survive sanitization. This bypasses SAFE_FOR_TEMPLATES and can allow a downstream template engine to evaluate attacker-supplied expressions. The string output path is not affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-23
Last Modified
2026-07-23
Generated
2026-07-23
AI Q&A
2026-07-23
EPSS Evaluated
N/A
NVD
CVE-2026-65900
EUVD
EUVD-2026-48269

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
cure53 dompurify From 3.0.0 (inc) to 3.4.8 (exc)
cure53 dompurify From 3.0.0 (inc) to 3.4.7 (inc)
dompurify dompurify From 3.0.0 (inc) to 3.4.8 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects DOMPurify versions 3.0.0 to 3.4.7 when configured with SAFE_FOR_TEMPLATES and a DOM output mode like RETURN_DOM. It fails to strip template expressions such as ${evil}, {{evil}}, or <%evil%> inside <template> elements because the sanitization process does not properly process template content during normalization. This allows malicious expressions to bypass sanitization and potentially execute attacker-controlled code in downstream template engines.

Detection Guidance

Check DOMPurify version with npm list dompurify or grep "version" in package.json. If version is between 3.0.0 and 3.4.7, it is vulnerable. Inspect application code for SAFE_FOR_TEMPLATES and DOM output modes like RETURN_DOM.

Impact Analysis

If you use a vulnerable version of DOMPurify with SAFE_FOR_TEMPLATES and DOM output modes, attackers could inject malicious template expressions that bypass sanitization. This may lead to cross-site scripting (XSS) attacks or session hijacking if the sanitized content is later processed by a template engine that evaluates these expressions.

Compliance Impact

This vulnerability could lead to unauthorized code execution or data exfiltration, which may violate compliance requirements under GDPR (data protection) or HIPAA (healthcare data security). Organizations using vulnerable versions may face increased risk of breaches, potentially resulting in regulatory penalties or reputational damage.

Mitigation Strategies

Upgrade DOMPurify to version 3.4.8 or later. If upgrading is not possible, disable SAFE_FOR_TEMPLATES and avoid DOM output modes like RETURN_DOM until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-65900. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart