DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode

Description

| Field | Value | |:——|:——| | Severity | Medium | | Affected | DOMPurify main at 883ac15, introduced in v1.0.10 (7fc196db) |

SAFE_FOR_TEMPLATES strips `` expressions from untrusted HTML.

Recommendation

Update the dompurify package to the latest compatible version. Followings are version details:

• Affected version(s): >= 1.0.10, < 3.4.0
• Patched version(s): 3.4.0

References

• GHSA-crv5-9vww-q3g8
• CVE-2026-41239
• CWE-1289
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Kysely has a MySQL SQL Injection via Backslash Escape Bypass in non-type-safe usage of JSON path keys. - CVE-2026-33442
• Parse Server has an auth provider validation bypass on login via partial authData - CVE-2026-33409
• Parse Server has a query condition depth bypass via pre-validation transform pipeline - CVE-2026-33498
• fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names - CVE-2026-25896

You might also like:

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

dompurify