DOMPurify versions >=3.0.0 and before 3.4.8, when configured with SAFE_FOR_TEMPLATES together with a DOM output mode (RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE), fail to strip template expressions (e.g. ${evil}, {{evil}}, <%evil%>) inside <template> element content. The final normalization/scrub pass (_scrubTemplateExpressions) uses a NodeIterator and node.normalize() that do not descend into template.content, so expressions that only form after adjacent text nodes merge survive sanitization. This bypasses SAFE_FOR_TEMPLATES and can allow a downstream template engine to evaluate attacker-supplied expressions. The string output path is not affected.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 1
- First seenCVSS 5.1 · cure53NVD modified 2026-10-24 13:10
Affected (CPE criteria) 1
cpe:2.3:a:cure53:dompurify:*:*:*:*:*:*:*:*
References 3
- https://github.com/cure53/DOMPurify/security/advisories/GHSA-gvmj-g25r-r7wr Exploit, Third Party Advisory
- https://www.vulncheck.com/advisories/dompurify-before-template-expression-injection-via-return-dom Third Party Advisory
- https://github.com/cure53/DOMPurify/security/advisories/GHSA-gvmj-g25r-r7wr Exploit, Third Party Advisory