DOMPurify CVE-2026-65900

Exploitation requires all three of the following conditions to be simultaneously true: (1) the application explicitly sets SAFE_FOR_TEMPLATES: true in its DOMPurify configuration; (2) the application uses one of the DOM output modes - RETURN_DOM: true, RETURN_DOM_FRAGMENT: true, or IN_PLACE: true - rather than the default string output; and (3) the resulting DOM output is subsequently consumed by a downstream template engine that processes expressions of the form ${...}, {{...}}, or <%...%>. The default DOMPurify string output path is explicitly confirmed unaffected. Applications using DOMPurify for standard XSS protection without these non-default flags are not vulnerable. The requirement for a specific non-default configuration combination, plus a downstream template engine in the data pipeline, substantially limits the realistic attack surface beyond what the raw CVSS vector suggests.

The CVSS 4.0 score of 5.1 (AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N) reflects a network-reachable attack requiring active user interaction, with impact limited to Low integrity on the subsequent system and no impact on the vulnerable component itself. This is not listed in CISA KEV and no public exploit code is cited in the available references, so exploitation probability cannot be confirmed from those signals; no EPSS score is present in the provided data. Real-world risk is substantially gated by deployment specifics: the vulnerable code path requires explicit use of both SAFE_FOR_TEMPLATES and a DOM output mode, both of which are non-default configurations. Applications using the default string output, or using SAFE_FOR_TEMPLATES without a DOM output mode, are confirmed unaffected. Despite the AC:L vector metric (which measures attacker-side conditions), the dependency on a specific server-side configuration choice narrows the realistic population considerably. The combination of a non-KEV status, no observed POC, medium CVSS 4.0 score, and non-default trigger conditions makes this a targeted remediation priority for affected deployments rather than an emergency response for the broader DOMPurify install base.

An attacker submits crafted HTML containing a <template> element whose content, after DOMPurify's KEEP_CONTENT processing removes a disallowed child element, leaves adjacent text nodes that merge to form ${attacker_code}. The application collects the DOM output via RETURN_DOM and passes the resulting tree to a downstream template engine such as Angular, Handlebars, or a server-side renderer, which evaluates the surviving expression and executes attacker-controlled code in the victim's browser or server context. No public exploit code has been identified, but the GHSA advisory provides sufficient source-level detail (file paths and line numbers) for a capable attacker to construct a proof of concept.