Fluid Attacks Database

Description

DOMPurify versions >=3.0.0 and before 3.4.8, when configured with SAFE_FOR_TEMPLATES together with a DOM output mode (RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE), fail to strip template expressions (e.g. ${evil}, {{evil}}, <%evil%>) inside

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 13	node-dompurify	=3.1.7+dfsg+~3.0.5-2 \|\| =3.2.5+dfsg-1 \|\| =3.3.2+dfsg-1 \|\| =3.3.3+dfsg-1 \|\| =3.3.3+dfsg-2 \|\| =3.4.1+dfsg-1 \|\| =3.4.12+dfsg-1 \|\| =3.4.13+dfsg-1 \|\| =3.4.13+dfsg-2 \|\| =3.4.16+dfsg-1 \|\| =3.4.2+dfsg-1 \|\| =3.4.5+dfsg-1	-
debian 12	node-dompurify	=2.4.1+dfsg+~2.4.0-1 \|\| =2.4.1+dfsg+~2.4.0-2 \|\| =2.4.1+dfsg+~2.4.0-2+deb12u1 \|\| =3.0.9+dfsg+~3.0.5-1 \|\| =3.1.6+dfsg+~3.0.5-1 \|\| =3.1.7+dfsg+~3.0.5-1 \|\| =3.1.7+dfsg+~3.0.5-2 \|\| =3.2.5+dfsg-1 \|\| =3.3.2+dfsg-1 \|\| =3.3.3+dfsg-1 \|\| =3.3.3+dfsg-2 \|\| =3.4.1+dfsg-1 \|\| =3.4.12+dfsg-1 \|\| =3.4.13+dfsg-1 \|\| =3.4.13+dfsg-2 \|\| =3.4.16+dfsg-1 \|\| =3.4.2+dfsg-1 \|\| =3.4.5+dfsg-1	-
debian 14	node-dompurify	=3.1.7+dfsg+~3.0.5-2 \|\| =3.2.5+dfsg-1 \|\| =3.3.2+dfsg-1 \|\| =3.3.3+dfsg-1 \|\| =3.3.3+dfsg-2 \|\| =3.4.1+dfsg-1 \|\| =3.4.2+dfsg-1 \|\| =3.4.5+dfsg-1 \|\| >=0 <3.4.12+dfsg-1	3.4.12+dfsg-1
npm	dompurify	>=3.0.0 <3.4.8	3.4.8
rpm rhel10	grafana-pcp	-	-
rpm rhel10	grafana	-	-
rpm rhel10	cockpit-image-builder	-	-

Aliases

1. CVE-2026-659002. NVD-2026-659003. OSV-DEBIAN-2026-659004. OSV-2026-659005. GHSA-gvmj-g25r-r7wr6. GCVE-2026-659007. SECURITY-TRACKER-CVE-2026-65900

References

1. https://github.com/cure53/DOMPurify/security/advisories/GHSA-gvmj-g25r-r7wr

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.