DOMPurify’s SAFE_FOR_TEMPLATES option fails to strip {{…}} expressions when used with the RETURN_DOM or RETURN_DOM_FRAGMENT modes. This allows attackers to inject malicious template code that is processed by template‑evaluating frameworks such as Vue 2, resulting in client‑side cross‑site scripting. The vulnerability is a classic CWEs 79 and 1289 code‑injection flaw that can compromise the confidentiality, integrity, and availability of a web application for any authenticated or unauthenticated user depending on the input surface.

The issue affects the DOMPurify library supplied by cure53. It is present in all releases starting with version 1.0.10 up to, but not including, the 3.4.0 release. Any deployment that uses DOMPurify v1.x or v2.x/3.x with the RETURN_DOM family in the specified range is potentially vulnerable.

With a CVSS score of 6.8 the vulnerability is classified as moderate. The EPSS score is below 1 % and it does not appear in the CISA KEV catalog, indicating low to very low current exploitation probability. Nevertheless, the attack vector is straightforward: any user can supply forged content that is sanitized via RETURN_DOM. Once processed by a vulnerable framework that interprets {{…}} syntax, the attacker can execute arbitrary JavaScript in the victim’s browser. The risk is amplified in applications that dynamically render untrusted content using DOMPurify in the affected modes.