SB2026071309 - Cross-site scripting in DOMPurify

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026071309

SB2026071309 - Cross-site scripting in DOMPurify

Published: July 13, 2026

Security Bulletin ID SB2026071309
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to execute arbitrary script in the victim's browser.

The vulnerability exists due to improper neutralization of script-related template expressions in template content in DOMPurify SAFE_FOR_TEMPLATES handling when sanitizing content using the RETURN_DOM or IN_PLACE output modes. A remote attacker can supply specially crafted template content with split expression text nodes to execute arbitrary script in the victim's browser.

The issue is specific to template content that is later normalized or evaluated by a template engine, allowing split text nodes to merge into a fully formed expression after sanitization.


Remediation

Install update from vendor's website.

References