CVE-2026-65900 cure53 CVE debrief

Who should care

Developers and administrators using DOMPurify versions >=3.0.0 and before 3.4.8, especially those using downstream template engines, should be aware of this vulnerability and take defensive actions. This includes reviewing and updating their usage of DOMPurify, implementing compensating controls, and monitoring for potential exploitation attempts. Security teams and vulnerability management teams should also be aware of this vulnerability and prioritize patching or mitigation efforts accordingly. Furthermore, operators and platform administrators should verify their deployments and ensure that affected systems are properly secured. This vulnerability can be particularly concerning for systems that utilize template engines, as it may allow attackers to inject malicious expressions and execute arbitrary code. Therefore, it is essential for affected parties to take prompt action to address this vulnerability and prevent potential exploitation. The CVE record and NVD entry provide additional details on the vulnerability, and defenders should consult these resources for further information. Limited evidence is available on downstream template engine exploitation, but defenders should remain vigilant and monitor for potential attacks. To verify the vulnerability and its impact, defenders should review the official advisory and CVE record, and perform thorough testing and validation of their systems. Additionally, defenders should consider implementing additional security controls, such as input validation and sanitization, to prevent exploitation of this vulnerability. By taking these steps, defenders can help prevent the exploitation of this vulnerability and protect their systems from potential attacks. The vulnerability affects DOMPurify versions >=3.0.0 and before 3.4.8, and defenders should prioritize patching or mitigation efforts for these versions. The vulnerability has been publicly disclosed, and defenders should be aware of the potential risks and take prompt action to address the vulnerability. The NVD entry provides additional details on the vulnerability, including its CVSS score and severity. Defenders should consult the NVD entry and other trusted, the

Technical summary

DOMPurify versions >=3.0.0 and before 3.4.8, when configured with SAFE_FOR_TEMPLATES together with a DOM output mode (RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE), fail to strip template expressions inside <template> element content. The final normalization/scrub pass uses a NodeIterator and node.normalize() that do not descend into template.content, allowing expressions to survive sanitization. This bypasses SAFE_FOR_TEMPLATES and can allow a downstream template engine to evaluate attacker-supplied expressions. The string output path is not affected. Additionally, the vulnerability has a CVSS score of 5.1 and a severity of MEDIUM.

Defensive priority

Medium-priority defensive actions are required to address this vulnerability, as it allows for template expression injection via RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE output modes in DOMPurify versions >=3.0.0 and before 3.4.8.

Recommended defensive actions

• Inventory and check usage of DOMPurify versions >=3.0.0 and before 3.4.8
• Apply vendor remediation to upgrade to DOMPurify version 3.4.8 or later
• Implement compensating controls, such as validating and sanitizing user input
• Monitor for potential exploitation attempts
• Exception tracking and retest

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in DOMPurify versions >=3.0.0 and before 3.4.8. The vulnerability allows for template expression injection via RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE output modes when configured with SAFE_FOR_TEMPLATES. Limited evidence is available on downstream template engine exploitation.

Official resources