DOMPurify CVE-2026-41239
MEDIUM
GHSA-crv5-9vww-q3g8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconAttacker crafts malformed HTML with split template expression
-
DeliveryHTML reaches vulnerable application via form/API
-
ExploitApplication calls DOMPurify.sanitize(input, {SAFE_FOR_TEMPLATES: true, RETURN_DOM: true})
-
InstallParser splits expression across text nodes separated by disallowed elements
-
C2First sanitization pass skips split nodes
-
ExecuteDisallowed elements removed, text nodes adjacent
-
ImpactDOM serialization merges nodes into valid {{...}} expression
-
Step 8Application mounts DOM in Vue 2 template engine
-
Step 9Vue compiles and executes expression
-
Step 10Arbitrary JavaScript executes in victim context
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The vulnerability requires all three conditions to be simultaneously met: (1) Application calls DOMPurify.sanitize() with both SAFE_FOR_TEMPLATES: true AND RETURN_DOM: true or RETURN_DOM_FRAGMENT: true configuration options; (2) The sanitized DOM result is mounted or inserted into a template-evaluating framework (e.g., Vue 2, Handlebars, EJS, or similar) that processes {{...}}, <%...%>, or ${...} expressions; (3) Attacker-controlled HTML input reaches the DOMPurify function. Applications using RETURN_DOM without template frameworks are not vulnerable because template expressions would not be evaluated. Similarly, applications using SAFE_FOR_TEMPLATES with string-mode sanitization (no RETURN_DOM) are not vulnerable because the second sanitization pass removes reassembled expressions. The attack does not require authentication, elevated privileges, or special browser features-it exploits a logic flaw in the library's per-output-mode handling. |
| Impact | CVSS 6.8 (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N) indicates network-accessible XSS with high complexity (HTML parsing behavior) and user interaction (page load/rendering). The high complexity rating reflects the intricate DOM normalization required; however, the exploit is practical and fully reproducible with a simple HTML file, lowering real-world attack complexity. EPSS score and KEV status not provided in input data. The vulnerability is confirmed by upstream vendor (Cure53, DOMPurify maintainers) with a public proof-of-concept and available patch (v3.4.0+). User interaction requirement (UI:R) reflects the need for a victim to load malicious HTML, which is typical of stored/reflected XSS. The impact scope is unchanged (S:U), affecting only the application context, not other systems. This is a legitimate, high-priority XSS in a widely-used library, but not critical due to AC:H and UI:R constraints. Exploitation requires both the vulnerable configuration (SAFE_FOR_TEMPLATES + RETURN_DOM) AND use of a template framework-deployments using RETURN_DOM without templates are unaffected. |
| Exploit ScenarioDerived | An attacker embeds malicious HTML in a web form or comment field: {<foo></foo>{constructor.constructor('alert(1)')()}<foo></foo>}. When a victim views the page, the web application sanitizes this input using DOMPurify with SAFE_FOR_TEMPLATES and RETURN_DOM enabled (a common pattern for client-side sanitization), then mounts the result in Vue 2. The split template expression reassembles during DOM serialization, Vue compiles and executes the expression, and arbitrary JavaScript runs in the victim's browser with their privileges and credentials. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 23, 2026
Cross-site scripting (XSS) in DOMPurify when using SAFE_FOR_TEMPLATES with RETURN_DOM or RETURN_DOM_FRAGMENT modes allows remote attackers to execute arbitrary JavaScript by crafting malformed HTML that reassembles into template expressions after DOM normalization. The vulnerability affects DOMPurify from v1.0.10 through at least v3.3.3, exploitable when sanitized output is mounted into template-evaluating frameworks like Vue 2. A proof-of-concept demonstrates reliable exploitation with alert(1) execution.
RemediationAI
Vendor-released patch: DOMPurify v3.4.0 and later. Upgrade immediately via npm update dompurify or update package.json to dompurify@>=3.4.0. The fix adds a normalize() call and regex scrubbing in the RETURN_DOM path before returning the DOM fragment, ensuring split template expressions are merged and re-checked. See patch details and release notes at https://github.com/cure53/DOMPurify/releases/tag/3.4.0. For applications that cannot immediately upgrade, workarounds include: (1) Avoid RETURN_DOM and RETURN_DOM_FRAGMENT modes-use string return (default) instead, which executes both sanitization passes; (2) If DOM return is required, disable SAFE_FOR_TEMPLATES if template framework is not used, or sanitize output a second time by converting to string, re-sanitizing, and re-parsing; (3) Apply Content Security Policy (CSP) with script-src restrictions to limit XSS impact, though this is a defense-in-depth measure, not a complete mitigation. Trade-off: Workaround (1) may require refactoring DOM handling; workaround (2) adds performance overhead.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
DOMPurify implements SAFE_FOR_TEMPLATES mode to strip template expressions (Mustache {{...}}, ERB <%...%>, and template literals ${...}) from HTML in two passes: first during DOM tree traversal (per-node), then via regex on the serialized HTML string. However, when RETURN_DOM or RETURN_DOM_FRAGMENT is specified, the function returns early before executing the second pass. An attacker can exploit this by splitting a template expression across multiple text nodes separated by disallowed elements (e.g., {<foo></foo>{payload}<foo></foo>}). During tree traversal, no single text node contains the complete {{...}} pattern, so pass #1 misses it. After DOMPurify removes the disallowed <foo> tags, adjacent text nodes are merged during DOM serialization, reconstructing the full template expression. When this malformed DOM is serialized to HTML and mounted in Vue 2 (or similar frameworks), the template expression is evaluated, executing attacker code. The root cause is incomplete sanitization of template expressions when the DOM path is taken (CWE-79: Improper Neutralization of Input During Web Page Generation).
Know when Node.js gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Primary rating from Vendor (https://github.com/cure53/DOMPurify).
CVSS VectorVendor: https://github.com/cure53/DOMPurify
Lifecycle Timeline
2DescriptionCVE.org
Summary
SAFE_FOR_TEMPLATES strips {{...}} expressions from untrusted HTML. This works in string mode but not with RETURN_DOM or RETURN_DOM_FRAGMENT, allowing XSS via template-evaluating frameworks like Vue 2.
Technical Details
DOMPurify strips template expressions in two passes:
- Per-node - each text node is checked during the tree walk (
purify.ts:1179-1191):
// pass #1: runs on every text node during tree walk
if (SAFE_FOR_TEMPLATES && currentNode.nodeType === NODE_TYPE.text) {
content = currentNode.textContent;
content = content.replace(MUSTACHE_EXPR, ' '); // {{...}} -> ' '
content = content.replace(ERB_EXPR, ' '); // <%...%> -> ' '
content = content.replace(TMPLIT_EXPR, ' '); // ${... -> ' '
currentNode.textContent = content;
}- Final string scrub - after serialization, the full HTML string is scrubbed again (
purify.ts:1679-1683). This is the safety net that catches expressions that only form after the DOM settles.
The RETURN_DOM path returns before pass #2 ever runs (purify.ts:1637-1661):
// purify.ts (simplified)
if (RETURN_DOM) {
// ... build returnNode ...
return returnNode; // <-- exits here, pass #2 never runs
}
// pass #2: only reached by string-mode callers
if (SAFE_FOR_TEMPLATES) {
serializedHTML = serializedHTML.replace(MUSTACHE_EXPR, ' ');
}
return serializedHTML;The payload {<foo></foo>{constructor.constructor('alert(1)')()}<foo></foo>} exploits this:
- Parser creates:
TEXT("{")→<foo>→TEXT("{payload}")→<foo>→TEXT("}")- no single node contains{{, so pass #1 misses it <foo>is not allowed, so DOMPurify removes it but keeps surrounding text- The three text nodes are now adjacent -
.outerHTMLreads them as{{payload}}, which Vue 2 compiles and executes
Reproduce
Open the following html in any browser and alert(1) pops up.
<!DOCTYPE html>
<html>
<body>
<script src="https://cdn.jsdelivr.net/npm/dompurify@3.3.3/dist/purify.min.js"></script>
<script src="https://cdn.jsdelivr.net/npm/vue@2.7.16/dist/vue.min.js"></script>
<script>
var dirty = '<div id="app">{<foo></foo>{constructor.constructor("alert(1)")()}<foo></foo>}</div>';
var dom = DOMPurify.sanitize(dirty, { SAFE_FOR_TEMPLATES: true, RETURN_DOM: true });
document.body.appendChild(dom.firstChild);
new Vue({ el: '#app' });
</script>
</body>
</html>Impact
Any application that sanitizes attacker-controlled HTML with SAFE_FOR_TEMPLATES: true and RETURN_DOM: true (or RETURN_DOM_FRAGMENT: true), then mounts the result into a template-evaluating framework, is vulnerable to XSS.
Recommendations
Fix
normalize() merges the split text nodes, then the same regex from the string path catches the expression. Placed before the fragment logic, this fixes both RETURN_DOM and RETURN_DOM_FRAGMENT.
if (RETURN_DOM) {
+ if (SAFE_FOR_TEMPLATES) {
+ body.normalize();
+ let html = body.innerHTML;
+ arrayForEach([MUSTACHE_EXPR, ERB_EXPR, TMPLIT_EXPR], (expr: RegExp) => {
+ html = stringReplace(html, expr, ' ');
+ });
+ body.innerHTML = html;
+ }
+
if (RETURN_DOM_FRAGMENT) {
returnNode = createDocumentFragment.call(body.ownerDocument);Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Affected Products (CPE)CVE.org
Remote code execution in n8n's workflow expression evaluation system allows an authenticated user with workflow creation
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
A vulnerability in NuPoint Messenger (NPM) of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to cond
Exploit-DB