Executive brief
DOMPurify, a library used to clean user-provided HTML to prevent security attacks, contains a flaw when configured to protect template engines while returning DOM objects. An attacker can bypass security filters by splitting malicious code across multiple elements inside a template tag, which the library fails to inspect properly. If a website then uses a template engine to process this content, it could lead to unauthorized script execution (XSS) or data theft, such as stealing session cookies.
Technical details
A vulnerability exists in DOMPurify's SAFE_FOR_TEMPLATES mode when combined with RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE modes. The root cause is that the _scrubTemplateExpressions function uses a NodeIterator that does not descend into the DocumentFragment of <template>.content. By splitting template expressions (e.g., ${...}) across adjacent text nodes within a <template> element, an attacker can bypass the per-node regex scrubbing. When a downstream framework later calls node.normalize() or accesses textContent, the fragments merge into a functional expression. This can lead to Cross-Site Scripting (XSS) or client-side template injection. The default string-based output path is not affected as it performs a final global regex replacement on the serialized HTML.
Affected products
- cure53 DOMPurify >= 3.0.0, <= 3.4.7
Timeline
- 2026-05-29: advisory: GitHub Advisory published
- 2026-05-29: disclosed
- 2026-05-29: patched: Fixed in version 3.4.8
References
- https://api.github.com/users/IamLeandrooooo
- https://github.com/IamLeandrooooo
- https://api.github.com/users/IamLeandrooooo/gists%7B/gist_id%7D
- https://api.github.com/users/IamLeandrooooo/repos
- https://avatars.githubusercontent.com/u/30774898?v=4
- https://api.github.com/users/IamLeandrooooo/events%7B/privacy%7D