CVE-2026-41239: medium-severity vulnerability in cure53 DOMPurify
DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
DOMPurify fails to remove template expressions (like {{...}}) when returning DOM objects instead of strings, allowing attackers to inject malicious code that gets executed by template frameworks like Vue 2.
The SAFE_FOR_TEMPLATES mode in DOMPurify versions 1.0.10–3.3.x improperly handles template syntax in RETURN_DOM and RETURN_DOM_FRAGMENT modes; an attacker can craft HTML with {{payload}} expressions that bypass sanitization and execute arbitrary code when processed by client-side template engines.
In the same product, most dangerous first.