DOMPurify Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability - CVE-2026-65900

DOMPurify versions gt3.0.0 and before 3.4.8 when configured with SAFE_FOR_TEMPLATES together with a DOM output mode (RETURN_DOM RETURN_DOM_FRAGMENT or IN_PLACE) fail to strip template expressions (e.g. evil evil ltevilgt) inside lttemplategt element content. The final normalization/scrub pass (_scrubTemplateExpressions) uses a NodeIterator and node.normalize() that do not descend into template.content so expressions that only form after adjacent text nodes merge survive sanitization. This bypasses SAFE_FOR_TEMPLATES and can allow a downstream template engine to evaluate attacker-supplied expressions. The string output path is not affected.