DOMPurify Template Expression Injection Vulnerability in Cure53 Software
CVE-2026-65900

5.1MEDIUM

Key Information:

Vendor: Cure53
Status: Dompurify
Vendor: CVE Published:; 23 July 2026

What is CVE-2026-65900?

An issue in DOMPurify versions 3.0.0 up to 3.4.8 enables template expression injection when using SAFE_FOR_TEMPLATES with specific DOM output modes. The sanitization process fails to adequately strip template expressions embedded within elements, which can lead to vulnerabilities if a downstream template engine evaluates these un-sanitized expressions. This flaw is critical for developers to address to ensure safe handling of user-generated content and avoid potential exploitation.

Affected Version(s)

DOMPurify 3.0.0 < 3.4.8

DOMPurify 3.4.8

References

https://github.com/cure53/DOMPurify/security/advisories/G...

vendor-advisory

https://www.vulncheck.com/advisories/dompurify-before-tem...

third-party-advisory

CVSS V4

Score:

5.1

Severity:

MEDIUM

Confidentiality:

None

Integrity:

None

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Attack Required:

None

Privileges Required:

Undefined

User Interaction:

Unknown

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Jul 23, 2026
Vulnerability Reserved
Jul 23, 2026

Credit

IamLeandrooooo

CVE-2026-65900 Data

JSON