PT-2026-63986 · Dompurify · Dompurify

Iamleandrooooo · CVE-2026-65900 · Published 2026-06-15 · Updated 2026-07-23

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions DOMPurify versions 3.0.0 through 3.4.7

Description When configured with SAFE FOR TEMPLATES and a DOM output mode (RETURN DOM, RETURN DOM FRAGMENT, or IN PLACE), the software fails to strip template expressions such as ${evil}, {{evil}}, or <%evil%> within <template> element content. This occurs because the scrubTemplateExpressions() function uses a NodeIterator and node.normalize() that do not descend into template.content, allowing expressions formed by the merging of adjacent text nodes to survive sanitization. This bypasses the SAFE FOR TEMPLATES protection and may allow a downstream template engine to evaluate attacker-supplied expressions. The string output path is not affected.

Recommendations Update DOMPurify to version 3.4.8 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-65900

GHSA-GVMJ-G25R-R7WR

Affected Products

Dompurify

References · 7

• 🔥 https://github.com/cure53/DOMPurify/security/advisories/GHSA-gvmj-g25r-r7wr · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65900.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-65900 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-65900 · Security Note
• https://osv.dev/vulnerability/GHSA-gvmj-g25r-r7wr · Vendor Advisory
• https://github.com/cure53/DOMPurify · Note
• https://vulncheck.com/advisories/dompurify-before-template-expression-injection-via-return-dom · Note