GHSA-cg2g-xh64-v4q7
DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes
When DOMPurify is configured with SAFE_FOR_TEMPLATES: true together with a DOM-returning mode (RETURN_DOM: true, RETURN_DOM_FRAGMENT: true, or IN_PLACE: true), template expressions such as {{...}}, ${...}, and <%...%> survive sanitization inside the text content of an attached shadow root. The post-walk safety net _scrubTemplateExpressions (src/purify.
- No known exploitation
- Severity
- Critical, CVSS 9.2 (v4.0)
- Affected packages
- dompurify (npm) >= 3.4.4, <= 3.4.16, fixed in 3.4.17 · GHSA-cg2g-xh64-v4q7