DOMPurify, when configured with SAFE_FOR_TEMPLATES and a DOM output mode such as RETURN_DOM, does not strip template expressions (e.g., ${evil}, {{evil}}, <%evil%>) inside the content of <template> elements. The sanitizer uses node.normalize() without descending into template.content, allowing expressions that are formed after adjacent text nodes merge to survive. This weakness (CWE‑79) enables an attacker to inject expressions that a downstream template engine may evaluate, potentially leading to code execution or other unintended behavior. The vulnerability is limited to DOM output modes and does not affect the string output path.

All versions of cure53 DOMPurify from 3.0.0 up to and including 3.4.7, which are vulnerable. Versions 3.4.8 and later contain a fix. The vulnerability is independent of operating system or runtime; it is tied only to the configuration of DOMPurify in client‑side or server‑side JavaScript.

The CVSS score is 5.1, indicating a moderate impact. The EPSS score is less than 1%, suggesting a low likelihood of exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a configuration that uses SAFE_FOR_TEMPLATES with a DOM output mode and an attacker’s input that includes template expressions inside a <template> element. The attack would most likely be performed through any untrusted data passing through DOMPurify before being fed into a template engine. Because the vulnerability operates at rendering time, the attack surface is limited to environments that both sanitize and render template content on the same side of the application. However, if the template engine evaluates expressions in a sandbox that grants access to the environment, the impact could be substantial.