Cross-site scripting in DOMPurify - CVE-2026-65900
Published: July 13, 2026 / Updated: September 14, 2026
Vulnerability identifier: #VU137372
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2026-65900
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary script in the victim's browser.
The vulnerability exists due to improper neutralization of script-related template expressions in template content in DOMPurify SAFE_FOR_TEMPLATES handling when sanitizing content using the RETURN_DOM or IN_PLACE output modes. A remote attacker can supply specially crafted template content with split expression text nodes to execute arbitrary script in the victim's browser.
The issue is specific to template content that is later normalized or evaluated by a template engine, allowing split text nodes to merge into a fully formed expression after sanitization.
Affected software
DOMPurify
Fedora
nextcloud
Fedora
nextcloud
How to mitigate CVE-2026-65900
Install security update from vendor's website.
DOMPurify - update to 3.4.8
nextcloud - addressed in versions 34.0.3-1.el10_2, 34.0.3-1.el10_3, 34.0.3-1.fc44
nextcloud - addressed in versions 34.0.3-1.el10_2, 34.0.3-1.el10_3, 34.0.3-1.fc44