{"id":"CVE-2026-65900","aliases":["CLSA-2026-1786731853","CLSA-2026-1786731971","CLSA-2026-1787602198","CLSA-2026-1789154068","CLSA-2026-1792155851","CLSA-2026-1792156267","CLSA-2026-1792156282","CLSA-2026-1792156382","CLSA-2026-1792156589","CLSA-2026-1792156694","CLSA-2026-1792156909","CLSA-2026-1792157013","CLSA-2026-1792157113","CLSA-2026-1792369062","CLSA-2026-1792369452","CLSA-2026-1792424561","CLSA-2026-1792424669","CLSA-2026-1792453557","CLSA-2026-1792473150","CLSA-2026-1792479087","CLSA-2026-1792486389","CLSA-2026-1792486395","CLSA-2026-1792495764","CLSA-2026-1792496892","CLSA-2026-1792594075","CLSA-2026-1792761229","CLSA-2026-1792933945","DEBIAN-CVE-2026-65900","EUVD-2026-48269","GHSA-55q2-fjhq-7xh7","GHSA-6688-9rhm-gjv2","GHSA-c2j3-45gr-mqc4","GHSA-c6gr-qvv4-5v3f","ROOT-APP-NPM-CVE-2026-65900","UBUNTU-CVE-2026-65900","openSUSE-SU-2026:11723-1"],"status":"published","title":"DOMPurify before 3.4.8 Template Expression Injection via RETURN_DOM","description":"DOMPurify versions \u003e=3.0.0 and before 3.4.8, when configured with SAFE_FOR_TEMPLATES together with a DOM output mode (RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE), fail to strip template expressions (e.g. ${evil}, {{evil}}, \u003c%evil%\u003e) inside \u003ctemplate\u003e element content. The final normalization/scrub pass (_scrubTemplateExpressions) uses a NodeIterator and node.normalize() that do not descend into template.content, so expressions that only form after adjacent text nodes merge survive sanitization. This bypasses SAFE_FOR_TEMPLATES and can allow a downstream template engine to evaluate attacker-supplied expressions. The string output path is not affected.","severity":{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.0031,"percentile":0.2406,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2026-07-23T13:16:19Z","modified":"2026-10-28T02:30:22Z","fixes":[{"ecosystem":"TuxCare:npm","package":"dompurify","fixed_in":["2.5.9-tuxcare.9","2.4.3-tuxcare.9","2.3.0-tuxcare.7","2.4.7-tuxcare.7"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-dompurify","fixed_in":["3.4.12+dfsg-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.3-tuxcare.0"},{"fixed":"3.2.3-tuxcare.3"}]}],"versions":["3.2.3","3.2.3-tuxcare.1","3.2.3-tuxcare.2"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.6-tuxcare.0"},{"fixed":"3.1.6-tuxcare.7"}]}],"versions":["3.1.6","3.1.6-tuxcare.1","3.1.6-tuxcare.2","3.1.6-tuxcare.3","3.1.6-tuxcare.4","3.1.6-tuxcare.5","3.1.6-tuxcare.6"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.7-tuxcare.0"},{"fixed":"3.2.7-tuxcare.1"}]}],"versions":["3.2.7"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.3-tuxcare.0"},{"fixed":"3.0.3-tuxcare.5"}]}],"versions":["3.0.3","3.0.3-tuxcare.1","3.0.3-tuxcare.2","3.0.3-tuxcare.3","3.0.3-tuxcare.4"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.3-tuxcare.0"},{"fixed":"3.1.3-tuxcare.2"}]}],"versions":["3.1.3","3.1.3-tuxcare.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.2-tuxcare.0"},{"fixed":"3.1.2-tuxcare.2"}]}],"versions":["3.1.2","3.1.2-tuxcare.1"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.4-tuxcare.0"},{"fixed":"3.1.4-tuxcare.2"}]}],"versions":["3.1.4","3.1.4-tuxcare.1"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.2-tuxcare.0"},{"fixed":"3.0.2-tuxcare.2"}]}],"versions":["3.0.2","3.0.2-tuxcare.1"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.9-tuxcare.0"},{"fixed":"3.0.9-tuxcare.2"}]}],"versions":["3.0.9","3.0.9-tuxcare.1"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.8-tuxcare.0"},{"fixed":"3.0.8-tuxcare.2"}]}],"versions":["3.0.8","3.0.8-tuxcare.1"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.1-tuxcare.0"},{"fixed":"3.0.1-tuxcare.2"}]}],"versions":["3.0.1","3.0.1-tuxcare.1"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.0-tuxcare.0"},{"fixed":"3.1.0-tuxcare.2"}]}],"versions":["3.1.0","3.1.0-tuxcare.1"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.11-tuxcare.0"},{"fixed":"3.0.11-tuxcare.2"}]}],"versions":["3.0.11","3.0.11-tuxcare.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.9-tuxcare.0"},{"fixed":"2.5.9-tuxcare.9"}]}],"versions":["2.5.9","2.5.9-tuxcare.1","2.5.9-tuxcare.2","2.5.9-tuxcare.3","2.5.9-tuxcare.4","2.5.9-tuxcare.5","2.5.9-tuxcare.6","2.5.9-tuxcare.7","2.5.9-tuxcare.8"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.6-tuxcare.0"},{"fixed":"3.0.6-tuxcare.3"}]}],"versions":["3.0.6","3.0.6-tuxcare.1","3.0.6-tuxcare.2"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.3-tuxcare.0"},{"fixed":"3.3.3-tuxcare.3"}]}],"versions":["3.3.3","3.3.3-tuxcare.1","3.3.3-tuxcare.2"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.6-tuxcare.0"},{"fixed":"3.2.6-tuxcare.3"}]}],"versions":["3.2.6","3.2.6-tuxcare.1","3.2.6-tuxcare.2"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.5-tuxcare.0"},{"fixed":"3.0.5-tuxcare.2"}]}],"versions":["3.0.5","3.0.5-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.3-tuxcare.0"},{"fixed":"2.4.3-tuxcare.9"}]}],"versions":["2.4.3","2.4.3-tuxcare.1","2.4.3-tuxcare.2","2.4.3-tuxcare.3","2.4.3-tuxcare.4","2.4.3-tuxcare.5","2.4.3-tuxcare.6","2.4.3-tuxcare.7","2.4.3-tuxcare.8"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.4-tuxcare.0"},{"fixed":"3.0.4-tuxcare.2"}]}],"versions":["3.0.4","3.0.4-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.0-tuxcare.0"},{"fixed":"2.3.0-tuxcare.7"}]}],"versions":["2.3.0","2.3.0-tuxcare.1","2.3.0-tuxcare.2","2.3.0-tuxcare.3","2.3.0-tuxcare.4","2.3.0-tuxcare.5","2.3.0-tuxcare.6"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.5-tuxcare.0"},{"fixed":"3.4.5-tuxcare.3"}]}],"versions":["3.4.5","3.4.5-tuxcare.1","3.4.5-tuxcare.2"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.6-tuxcare.0"},{"fixed":"3.4.6-tuxcare.3"}]}],"versions":["3.4.6","3.4.6-tuxcare.1","3.4.6-tuxcare.2"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.7-tuxcare.0"},{"fixed":"3.4.7-tuxcare.3"}]}],"versions":["3.4.7","3.4.7-tuxcare.1","3.4.7-tuxcare.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.1-tuxcare.0"},{"fixed":"3.1.1-tuxcare.3"}]}],"versions":["3.1.1","3.1.1-tuxcare.1","3.1.1-tuxcare.2"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.7-tuxcare.0"},{"fixed":"2.4.7-tuxcare.7"}]}],"versions":["2.4.7","2.4.7-tuxcare.1","2.4.7-tuxcare.2","2.4.7-tuxcare.3","2.4.7-tuxcare.4","2.4.7-tuxcare.5","2.4.7-tuxcare.6"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.0-tuxcare.0"},{"fixed":"3.4.0-tuxcare.1"}]}],"versions":["3.4.0"],"bundled":9},{"source":"osv","ecosystem":"Debian:12","package":"node-dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.1+dfsg+~2.4.0-1","2.4.1+dfsg+~2.4.0-2","2.4.1+dfsg+~2.4.0-2+deb12u1","3.0.9+dfsg+~3.0.5-1","3.1.6+dfsg+~3.0.5-1","3.1.7+dfsg+~3.0.5-1","3.1.7+dfsg+~3.0.5-2","3.2.5+dfsg-1","3.3.2+dfsg-1","3.3.3+dfsg-1","3.3.3+dfsg-2","3.4.1+dfsg-1","3.4.12+dfsg-1","3.4.13+dfsg-1","3.4.13+dfsg-2","3.4.16+dfsg-1","3.4.2+dfsg-1","3.4.5+dfsg-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.7+dfsg+~3.0.5-2","3.2.5+dfsg-1","3.3.2+dfsg-1","3.3.3+dfsg-1","3.3.3+dfsg-2","3.4.1+dfsg-1","3.4.12+dfsg-1","3.4.13+dfsg-1","3.4.13+dfsg-2","3.4.16+dfsg-1","3.4.2+dfsg-1","3.4.5+dfsg-1"]},{"source":"osv","ecosystem":"Debian:14","package":"node-dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.12+dfsg-1"}]}],"versions":["3.1.7+dfsg+~3.0.5-2","3.2.5+dfsg-1","3.3.2+dfsg-1","3.3.3+dfsg-1","3.3.3+dfsg-2","3.4.1+dfsg-1","3.4.2+dfsg-1","3.4.5+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.0+dfsg-2","2.3.3+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.1+dfsg+~2.4.0-1","3.0.9+dfsg+~3.0.5-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-dompurify","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.7+dfsg+~3.0.5-2","3.3.3+dfsg-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-comfyui-frontend-package","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.52.7-1.1"}]}],"bundled":3}],"products":[{"vendor":"cure53","product":"dompurify"}],"references":[{"url":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-gvmj-g25r-r7wr","tags":["vendor-advisory","exploit","Exploit","Third Party Advisory","advisory","report"]},{"url":"https://www.vulncheck.com/advisories/dompurify-before-template-expression-injection-via-return-dom","tags":["third-party-advisory","Third Party Advisory","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65900.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65900","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-65900","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-65900","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-65900","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65898","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65899","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65900","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-65900","title":"DOMPurify before 3.4.8 Template Expression Injection via RETURN_DOM","description":"DOMPurify versions \u003e=3.0.0 and before 3.4.8, when configured with SAFE_FOR_TEMPLATES together with a DOM output mode (RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE), fail to strip template expressions (e.g. ${evil}, {{evil}}, \u003c%evil%\u003e) inside \u003ctemplate\u003e element content. The final normalization/scrub pass (_scrubTemplateExpressions) uses a NodeIterator and node.normalize() that do not descend into template.content, so expressions that only form after adjacent text nodes merge survive sanitization. This bypasses SAFE_FOR_TEMPLATES and can allow a downstream template engine to evaluate attacker-supplied expressions. The string output path is not affected.","status":"published","published":"2026-07-23T13:16:19.045Z","modified":"2026-07-23T18:02:48.345Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T13:37:13.934727Z"}],"euvd":[{"id":"EUVD-2026-48269","description":"DOMPurify versions \u003e=3.0.0 and before 3.4.8, when configured with SAFE_FOR_TEMPLATES together with a DOM output mode (RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE), fail to strip template expressions (e.g. ${evil}, {{evil}}, \u003c%evil%\u003e) inside \u003ctemplate\u003e element content. The final normalization/scrub pass (_scrubTemplateExpressions) uses a NodeIterator and node.normalize() that do not descend into template.content, so expressions that only form after adjacent text nodes merge survive sanitization. This bypasses SAFE_FOR_TEMPLATES and can allow a downstream template engine to evaluate attacker-supplied expressions. The string output path is not affected.","status":"published","published":"2026-07-23T13:16:19Z","modified":"2026-07-23T18:02:48Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"updated_at":"2026-11-02T18:19:42.161106Z"}],"nvd":[{"id":"CVE-2026-65900","description":"DOMPurify versions \u003e=3.0.0 and before 3.4.8, when configured with SAFE_FOR_TEMPLATES together with a DOM output mode (RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE), fail to strip template expressions (e.g. ${evil}, {{evil}}, \u003c%evil%\u003e) inside \u003ctemplate\u003e element content. The final normalization/scrub pass (_scrubTemplateExpressions) uses a NodeIterator and node.normalize() that do not descend into template.content, so expressions that only form after adjacent text nodes merge survive sanitization. This bypasses SAFE_FOR_TEMPLATES and can allow a downstream template engine to evaluate attacker-supplied expressions. The string output path is not affected.","status":"published","published":"2026-07-23T14:18:04.843Z","modified":"2026-10-24T13:10:00.147Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:12:32.473901Z"}],"osv":[{"id":"CVE-2026-65900","title":"DOMPurify before 3.4.8 Template Expression Injection via RETURN_DOM","description":"DOMPurify versions \u003e=3.0.0 and before 3.4.8, when configured with SAFE_FOR_TEMPLATES together with a DOM output mode (RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE), fail to strip template expressions (e.g. ${evil}, {{evil}}, \u003c%evil%\u003e) inside \u003ctemplate\u003e element content. The final normalization/scrub pass (_scrubTemplateExpressions) uses a NodeIterator and node.normalize() that do not descend into template.content, so expressions that only form after adjacent text nodes merge survive sanitization. This bypasses SAFE_FOR_TEMPLATES and can allow a downstream template engine to evaluate attacker-supplied expressions. The string output path is not affected.","status":"published","published":"2026-07-23T13:16:19.045Z","modified":"2026-10-28T02:30:22.423972088Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:45:14.46177Z"},{"id":"DEBIAN-CVE-2026-65900","description":"DOMPurify versions \u003e=3.0.0 and before 3.4.8, when configured with SAFE_FOR_TEMPLATES together with a DOM output mode (RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE), fail to strip template expressions (e.g. ${evil}, {{evil}}, \u003c%evil%\u003e) inside \u003ctemplate\u003e element content. The final normalization/scrub pass (_scrubTemplateExpressions) uses a NodeIterator and node.normalize() that do not descend into template.content, so expressions that only form after adjacent text nodes merge survive sanitization. This bypasses SAFE_FOR_TEMPLATES and can allow a downstream template engine to evaluate attacker-supplied expressions. The string output path is not affected.","status":"published","published":"2026-07-23T14:18:04.843Z","modified":"2026-10-25T09:47:31.653380405Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:45:58.699079Z"},{"id":"UBUNTU-CVE-2026-65900","description":"DOMPurify versions \u003e=3.0.0 and before 3.4.8, when configured with SAFE_FOR_TEMPLATES together with a DOM output mode (RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE), fail to strip template expressions (e.g. ${evil}, {{evil}}, \u003c%evil%\u003e) inside \u003ctemplate\u003e element content. The final normalization/scrub pass (_scrubTemplateExpressions) uses a NodeIterator and node.normalize() that do not descend into template.content, so expressions that only form after adjacent text nodes merge survive sanitization. This bypasses SAFE_FOR_TEMPLATES and can allow a downstream template engine to evaluate attacker-supplied expressions. The string output path is not affected.","status":"published","published":"2026-07-23T14:18:00Z","modified":"2026-07-29T10:18:57.59919028Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"},{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:56:53.710209Z"},{"id":"CLSA-2026-1786731853","title":"TuxCare security update for dompurify (10 CVEs)","description":"TuxCare rebuilt dompurify to address 10 CVEs. Fixed in 3.2.3-tuxcare.3.","status":"published","published":"2026-08-14T18:24:13Z","modified":"2026-10-15T09:46:00.690246088Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1786731971","title":"TuxCare security update for dompurify (7 CVEs)","description":"TuxCare rebuilt dompurify to address 7 CVEs. Fixed in 3.1.6-tuxcare.7.","status":"published","published":"2026-08-14T18:26:11Z","modified":"2026-10-15T09:45:59.894668945Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1787602198","title":"TuxCare security update for dompurify (10 CVEs)","description":"TuxCare rebuilt dompurify to address 10 CVEs. Fixed in 3.2.7-tuxcare.1.","status":"published","published":"2026-08-24T20:09:58Z","modified":"2026-10-15T09:48:03.099706625Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1789154068","title":"TuxCare security update for dompurify (12 CVEs)","description":"TuxCare rebuilt dompurify to address 12 CVEs. Fixed in 3.0.3-tuxcare.5.","status":"published","published":"2026-09-11T19:14:28Z","modified":"2026-10-16T19:13:11.209772816Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1792155851","title":"TuxCare security update for dompurify (12 CVEs)","description":"TuxCare rebuilt dompurify to address 12 CVEs. Fixed in 3.1.3-tuxcare.2.","status":"published","published":"2026-10-16T13:04:11Z","modified":"2026-10-21T20:43:23.163914038Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"CLSA-2026-1792156267","title":"TuxCare security update for dompurify (9 CVEs)","description":"TuxCare rebuilt dompurify to address 9 CVEs. Fixed in 3.1.2-tuxcare.2.","status":"published","published":"2026-10-16T13:11:07Z","modified":"2026-10-21T20:43:22.742858668Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"CLSA-2026-1792156282","title":"TuxCare security update for dompurify (11 CVEs)","description":"TuxCare rebuilt dompurify to address 11 CVEs. Fixed in 3.1.4-tuxcare.2.","status":"published","published":"2026-10-16T13:11:22Z","modified":"2026-10-21T20:43:22.552871845Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"CLSA-2026-1792156382","title":"TuxCare security update for dompurify (9 CVEs)","description":"TuxCare rebuilt dompurify to address 9 CVEs. Fixed in 3.0.2-tuxcare.2.","status":"published","published":"2026-10-16T13:13:02Z","modified":"2026-10-21T20:43:22.190952605Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"CLSA-2026-1792156589","title":"TuxCare security update for dompurify (10 CVEs)","description":"TuxCare rebuilt dompurify to address 10 CVEs. Fixed in 3.0.9-tuxcare.2.","status":"published","published":"2026-10-16T13:16:29Z","modified":"2026-10-21T20:43:20.928803832Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"CLSA-2026-1792156694","title":"TuxCare security update for dompurify (11 CVEs)","description":"TuxCare rebuilt dompurify to address 11 CVEs. Fixed in 3.0.8-tuxcare.2.","status":"published","published":"2026-10-16T13:18:14Z","modified":"2026-10-21T20:43:18.588659369Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"CLSA-2026-1792156909","title":"TuxCare security update for dompurify (10 CVEs)","description":"TuxCare rebuilt dompurify to address 10 CVEs. Fixed in 3.0.1-tuxcare.2.","status":"published","published":"2026-10-16T13:21:49Z","modified":"2026-10-21T20:43:22.31228165Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"CLSA-2026-1792157013","title":"TuxCare security update for dompurify (13 CVEs)","description":"TuxCare rebuilt dompurify to address 13 CVEs. Fixed in 3.1.0-tuxcare.2.","status":"published","published":"2026-10-16T13:23:33Z","modified":"2026-10-21T20:43:22.452640022Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"CLSA-2026-1792157113","title":"TuxCare security update for dompurify (12 CVEs)","description":"TuxCare rebuilt dompurify to address 12 CVEs. Fixed in 3.0.11-tuxcare.2.","status":"published","published":"2026-10-16T13:25:13Z","modified":"2026-10-21T20:43:21.625485698Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"CLSA-2026-1792369062","title":"TuxCare security update for dompurify (1 CVE)","description":"TuxCare rebuilt dompurify to address 1 CVE. Fixed in 2.5.9-tuxcare.9.","status":"published","published":"2026-10-19T00:17:42Z","modified":"2026-10-19T07:46:32.21245613Z","updated_at":"2026-11-02T15:43:53.353888Z"},{"id":"CLSA-2026-1792369452","title":"TuxCare security update for dompurify (6 CVEs)","description":"TuxCare rebuilt dompurify to address 6 CVEs. Fixed in 3.0.6-tuxcare.3.","status":"published","published":"2026-10-19T00:24:12Z","modified":"2026-10-19T07:45:38.150098133Z","updated_at":"2026-11-02T15:43:53.353888Z"},{"id":"CLSA-2026-1792424561","title":"TuxCare security update for dompurify (9 CVEs)","description":"TuxCare rebuilt dompurify to address 9 CVEs. Fixed in 3.3.3-tuxcare.3.","status":"published","published":"2026-10-19T15:42:41Z","modified":"2026-10-19T19:15:12.229054081Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792424669","title":"TuxCare security update for dompurify (9 CVEs)","description":"TuxCare rebuilt dompurify to address 9 CVEs. Fixed in 3.2.6-tuxcare.3.","status":"published","published":"2026-10-19T15:44:29Z","modified":"2026-10-19T19:15:02.915010976Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792453557","title":"TuxCare security update for dompurify (5 CVEs)","description":"TuxCare rebuilt dompurify to address 5 CVEs. Fixed in 3.0.5-tuxcare.2.","status":"published","published":"2026-10-19T23:45:57Z","modified":"2026-10-20T01:45:14.102972225Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1792473150","title":"TuxCare security update for dompurify (1 CVE)","description":"TuxCare rebuilt dompurify to address 1 CVE. Fixed in 2.4.3-tuxcare.9.","status":"published","published":"2026-10-20T05:12:30Z","modified":"2026-10-20T07:15:06.873327103Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1792479087","title":"TuxCare security update for dompurify (5 CVEs)","description":"TuxCare rebuilt dompurify to address 5 CVEs. Fixed in 3.0.4-tuxcare.2.","status":"published","published":"2026-10-20T06:51:27Z","modified":"2026-10-20T13:45:06.956605427Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1792486389","title":"TuxCare security update for dompurify (1 CVE)","description":"TuxCare rebuilt dompurify to address 1 CVE. Fixed in 2.3.0-tuxcare.7.","status":"published","published":"2026-10-20T08:53:09Z","modified":"2026-10-20T13:45:10.557862716Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1792486395","title":"TuxCare security update for dompurify (4 CVEs)","description":"TuxCare rebuilt dompurify to address 4 CVEs. Fixed in 3.4.5-tuxcare.3.","status":"published","published":"2026-10-20T08:53:15Z","modified":"2026-10-20T13:45:10.569475245Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1792495764","title":"TuxCare security update for dompurify (4 CVEs)","description":"TuxCare rebuilt dompurify to address 4 CVEs. Fixed in 3.4.6-tuxcare.3.","status":"published","published":"2026-10-20T11:29:24Z","modified":"2026-10-20T13:45:02.997749284Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1792496892","title":"TuxCare security update for dompurify (2 CVEs)","description":"TuxCare rebuilt dompurify to address 2 CVEs. Fixed in 3.4.7-tuxcare.3.","status":"published","published":"2026-10-20T11:48:12Z","modified":"2026-10-20T13:45:09.607990504Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1792594075","title":"TuxCare security update for dompurify (11 CVEs)","description":"TuxCare rebuilt dompurify to address 11 CVEs. Fixed in 3.1.1-tuxcare.3.","status":"published","published":"2026-10-21T14:47:55Z","modified":"2026-10-21T20:31:56.603365391Z","updated_at":"2026-11-02T15:43:54.672859Z"},{"id":"CLSA-2026-1792761229","title":"TuxCare security update for dompurify (1 CVE)","description":"TuxCare rebuilt dompurify to address 1 CVE. Fixed in 2.4.7-tuxcare.7.","status":"published","published":"2026-10-23T13:13:49Z","modified":"2026-10-23T19:15:09.367380798Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1792933945","title":"TuxCare security update for dompurify (12 CVEs)","description":"TuxCare rebuilt dompurify to address 12 CVEs. Fixed in 3.4.0-tuxcare.1.","status":"published","published":"2026-10-25T13:12:25Z","modified":"2026-10-25T19:15:03.066551076Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"openSUSE-SU-2026:11723-1","title":"python313-comfyui-frontend-package-1.52.7-1.1 on GA media","description":"These are all security issues fixed in the python313-comfyui-frontend-package-1.52.7-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-08T00:00:00Z","modified":"2026-09-09T10:00:05.707638977Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"ROOT-APP-NPM-CVE-2026-65900","title":"CVE-2026-65900 in @rootio/dompurify - Patched by Root","description":"Root has patched CVE-2026-65900 in the @rootio/dompurify package for Root:npm. Multiple fixed versions available.","status":"withdrawn","published":"2026-07-28T08:35:32Z","modified":"2026-07-29T08:00:21.288095282Z","updated_at":"2026-11-02T15:53:27.649662Z"}]}}