Cross-site scripting in DOMPurify - #VU137372
Published: July 13, 2026
Vulnerability identifier: #VU137372
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Green
CVE-ID: N/A
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Cure53
Affected software:
DOMPurify
DOMPurify
Detailed vulnerability description
The vulnerability allows a remote attacker to execute arbitrary script in the victim's browser.
The vulnerability exists due to improper neutralization of script-related template expressions in template content in DOMPurify SAFE_FOR_TEMPLATES handling when sanitizing content using the RETURN_DOM or IN_PLACE output modes. A remote attacker can supply specially crafted template content with split expression text nodes to execute arbitrary script in the victim's browser.
The issue is specific to template content that is later normalized or evaluated by a template engine, allowing split text nodes to merge into a fully formed expression after sanitization.
Remediation
Install security update from vendor's website.