CVE-2026-65900: DOMPurify before 3.4.8 Template Expression Injection via RETURN_DOM
Vulnerability summary
CVE-2026-65900 is a medium (CVSS 6.1) vulnerability in cure53 dompurify. EPSS estimates a 0.31% chance of exploitation in the next 30 days, higher than 23.9% of scored vulnerabilities. 1 public exploit is recorded.
Not severe (CVSS 5.1, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 1 · Related 2Timeline
- 23-07-2026PublishedVulnerability first disclosed.
- 23-07-2026Last modifiedVulnerability information updated.
Description
DOMPurify versions >=3.0.0 and before 3.4.8, when configured with SAFE_FOR_TEMPLATES together with a DOM output mode (RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE), fail to strip template expressions (e.g. ${evil}, {{evil}}, <%evil%>) inside <template> element content. The final normalization/scrub pass (_scrubTemplateExpressions) uses a NodeIterator and node.normalize() that do not descend into template.content, so expressions that only form after adjacent text nodes merge survive sanitization. This bypasses SAFE_FOR_TEMPLATES and can allow a downstream template engine to evaluate attacker-supplied expressions. The string output path is not affected.
CVSS metrics
10 scores · 7 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated5.1MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
- OSV · DebianEcosystem advisory · calculated5.1MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · WolfiEcosystem advisory · calculated5.1MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
- OSV · NpmEcosystem advisory · calculated5.1MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P
- OSV · ChainguardEcosystem advisory · calculated5.1MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
- NVDNIST5.1MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · UbuntuEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- NVDNIST6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS trend
Probability
0.31%
Chance of exploitation in the next 30 days
Percentile
24%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.31% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundDompurify
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard50 products
- airflow-2All versions (No fix recorded)
- airflow-core-2All versions (No fix recorded)
- gitlab-rails-ce-18.1All versions (No fix recorded)
- gitlab-rails-ce-18.10All versions (No fix recorded)
- gitlab-rails-ce-18.11All versions (No fix recorded)
Wolfi4 products
- langfuse-3-compat< 3.225.7-r6
- langfuse-3-worker< 3.191.0-r0
- nextcloud-server-32< 32.0.12-r0
- nextcloud-server-33< 33.0.6-r0
Cure531 product
- dompurify≥ 3.0.0, < 3.4.8
Debian1 product
- node-dompurifyAll versions (No fix recorded) | < 3.4.12+dfsg-1
Npm1 product
- dompurify≥ 3.0.0, < 3.4.8
Ubuntu1 product
- node-dompurifyAll versions (No fix recorded)
6 vendors · 58 products
References
8 links- github.com/cure53/DOMPurify/security/advisories/GHSA-gvmj-g25r-r7wrVendor AdvisoryREPORTAdvisoryWEBExploitThird Party Advisory
- www.vulncheck.com/advisories/dompurify-before-template-expression-injection-via-return-domThird Party AdvisoryAdvisory
- github.com/cure53/DOMPurifyPACKAGE