Which versions of DOMPurify are affected by CVE-2026-65900?

SAFE_FOR_TEMPLATES bypass in DOMPurify 3.0.0-3.4.7 allows template expressions such as ${evil}, {{evil}}, and to survive sanitization when DOM output modes (RETURN_DOM, RETURN_DOM_FRAGMENT,…. A patch is available.

Is there a public PoC exploit available for CVE-2026-65900?

Yes, a public proof-of-concept exploit is available for CVE-2026-65900. Prioritise patching immediately. EPSS: 0.2%.

Is there a patch available for CVE-2026-65900?

Yes, a patch is available for CVE-2026-65900. Update the affected software to the latest version immediately.

DOMPurify CVE-2026-65900

Q: What is the CVSS score of CVE-2026-65900?

CVE-2026-65900 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-48269 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-23 VulnCheck

XSS Dompurify Suse Red Hat

5.1

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.1 MEDIUM

Network-delivered XSS requiring victim interaction; scope changes because the downstream template engine context is affected beyond DOMPurify itself; no direct C/I/A impact on the vulnerable component.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

SUSE

6.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Red Hat

6.1 MEDIUM

qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Jul 23, 2026 - 15:18 EUVD

Source Code Evidence Fetched

Jul 23, 2026 - 13:55 vuln.today

Analysis Generated

Jul 23, 2026 - 13:55 vuln.today

CVE Published

Jul 23, 2026 - 13:16 cve.org

MEDIUM 5.1

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

6 npm packages depend on dompurify (6 direct, 0 indirect)

Ecosystem-wide dependent count for version 3.0.0.

DescriptionCVE.org

DOMPurify versions >=3.0.0 and before 3.4.8, when configured with SAFE_FOR_TEMPLATES together with a DOM output mode (RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE), fail to strip template expressions (e.g. ${evil}, {{evil}}, <%evil%>) inside <template> element content. The final normalization/scrub pass (_scrubTemplateExpressions) uses a NodeIterator and node.normalize() that do not descend into template.content, so expressions that only form after adjacent text nodes merge survive sanitization. This bypasses SAFE_FOR_TEMPLATES and can allow a downstream template engine to evaluate attacker-supplied expressions. The string output path is not affected.

AnalysisAI

SAFE_FOR_TEMPLATES bypass in DOMPurify 3.0.0-3.4.7 allows template expressions such as ${evil}, {{evil}}, and <%evil%> to survive sanitization when DOM output modes (RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE) are used alongside SAFE_FOR_TEMPLATES: true. The final normalization pass (_scrubTemplateExpressions) employs a NodeIterator that, per DOM specification, does not descend into <template>.content - a separate DocumentFragment outside the normal child-node tree - meaning split text nodes that merge into exploitable expressions inside template content are never caught. Downstream template engines receiving this output may evaluate attacker-supplied expressions, producing XSS or template injection outcomes; no public exploit is identified at time of analysis, and the string output path is explicitly confirmed unaffected.

Technical ContextAI

DOMPurify (npm: dompurify, CPE: cpe:2.3:a:cure53:dompurify:*:*:*:*:*:*:*:*) is the de facto HTML sanitization library for JavaScript front-ends. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation). SAFE_FOR_TEMPLATES operates through two mechanisms: per-node scrubbing in _sanitizeElements (purify.ts:1403) and a final normalization pass in _scrubTemplateExpressions (purify.ts:1115-1117). The normalization pass calls node.normalize() to merge adjacent text nodes and then walks them to strip expressions that only appear post-merge. However, both the NodeIterator used for this walk and node.normalize() are specified by the DOM standard to not traverse or normalize nodes inside <template>.content, which is a detached DocumentFragment. When DOMPurify removes a disallowed element with KEEP_CONTENT: true (the default), it moves the element's text children into the parent (purify.ts:1361-1373), potentially creating adjacent text nodes inside <template>.content that together form a template expression. Since the normalization pass never reaches template.content, these merged expressions escape sanitization intact and are forwarded to downstream template engines.

RemediationAI

Vendor-released patch: 3.4.8. Upgrade DOMPurify to version 3.4.8 or later via npm (npm install dompurify@3.4.8 or equivalent package manager command); the fix is documented in the GHSA advisory at https://github.com/cure53/DOMPurify/security/advisories/GHSA-gvmj-g25r-r7wr. If an immediate upgrade is not feasible, the most effective targeted workaround is to switch from DOM output modes to the default string output path by removing RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE from the DOMPurify configuration, as the string path is explicitly confirmed unaffected - this trade-off is that callers receiving a string rather than a DOM node must adjust downstream handling. A second workaround is to disable the SAFE_FOR_TEMPLATES flag and instead perform post-sanitization template expression stripping using a separate, purpose-built step before handing output to the template engine; however, this approach is error-prone and should not be treated as a permanent solution. Applications that do not combine both SAFE_FOR_TEMPLATES and a DOM output mode require no action.

More in Dompurify

View all

CVE-2024-47875 MEDIUM This Month POC

6.1 Oct 11

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. Rated medium severity (CVSS 6

CVE-2020-26870 MEDIUM This Month POC

6.1 Oct 07

Cure53 DOMPurify before 2.0.17 allows mutation XSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exp

CVE-2019-16728 MEDIUM This Month POC

6.1 Sep 24

DOMPurify before 2.0.1 allows XSS because of innerHTML mutation XSS (mXSS) for an SVG element or a MATH element, as demo

CVE-2024-48910 CRITICAL Act Now

9.8 Oct 31

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. Rated critical severity (CVSS

CVE-2026-65914 MEDIUM This Month POC

5.3 Jul 23

Mutation-XSS in DOMPurify before 3.3.2 enables JavaScript execution in victim browsers when sanitized output is re-inser

CVE-2026-65902 MEDIUM This Month POC

5.3 Jul 23

Hook mutation pollution in DOMPurify <= 3.4.5 allows persistent bypass of HTML sanitization defaults when application-in

CVE-2026-65899 MEDIUM This Month POC

5.1 Jul 23

Trusted Types policy state contamination in DOMPurify 3.0.0-3.4.8 allows a previously supplied TRUSTED_TYPES_POLICY to s

CVE-2026-65913 MEDIUM This Month POC

5.1 Jul 23

Prototype pollution in DOMPurify's USE_PROFILES mode enables DOM-based XSS by causing the sanitizer to accept event hand

CVE-2026-65912 MEDIUM This Month POC

5.1 Jul 23

URI validation bypass in DOMPurify 3.3.1 and earlier allows `javascript:` protocol payloads to survive HTML sanitization

CVE-2026-65901 MEDIUM This Month POC

5.1 Jul 23

Cross-site scripting in DOMPurify 3.4.6 and earlier enables script execution when the library's IN_PLACE sanitization mo

CVE-2026-65898 MEDIUM This Month POC

5.1 Jul 23

Stored XSS is achievable in applications using DOMPurify's setConfig() API combined with an uponSanitizeAttribute hook t

CVE-2025-26791 MEDIUM This Month POC

4.5 Feb 14

DOMPurify before 3.2.4 has an incorrect template literal regular expression, sometimes leading to mutation cross-site sc

Same weakness CWE-79 – Cross-site Scripting (XSS)

View all

CVE-2020-3580 MEDIUM POC

6.1

CVE-2013-7389 MEDIUM POC

4.3

CVE-2021-25299 MEDIUM POC

6.1

CVE-2014-2120 MEDIUM

6.1

CVE-2023-40000 HIGH POC

8.3

CVE-2016-8581 MEDIUM POC

6.1

CVE-2013-5223 MEDIUM POC

5.4

CVE-2025-52367 MEDIUM POC

5.4

Same technique XSS

View all

CVE-2017-9248 CRITICAL POC

9.8

CVE-2020-3580 MEDIUM POC

6.1

CVE-2013-1710 CRITICAL POC

10.0

CVE-2013-7389 MEDIUM POC

4.3

CVE-2021-25299 MEDIUM POC

6.1

CVE-2014-2120 MEDIUM

6.1

CVE-2023-40000 HIGH POC

8.3

CVE-2024-52875 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Module for SAP Applications 15 SP7	Affected
SUSE Linux Enterprise Server 16.0	Affected
SUSE Linux Enterprise Server 16.1	Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7	Affected
SUSE Linux Enterprise Server for SAP applications 16.0	Affected

CVE-2026-65900 vulnerability details – vuln.today

Back

DOMPurify CVE-2026-65900

Severity by source

CVSS VectorVendor: VulnCheck

Lifecycle Timeline

Blast Radius

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in Dompurify

Same weakness CWE-79 – Cross-site Scripting (XSS)

Same technique XSS

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code