Bug 2506425 (CVE-2026-65900)
| Summary: | CVE-2026-65900 dompurify: DOMPurify: Template expression injection allows information disclosure | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | aazores, abarbaro, abrianik, akhatavk, akostadi, alizardo, amasferr, amctagga, anjoseph, anpicker, aoconnor, aos-team-art-private, asdas, ataylor, bniver, cdrage, cmah, dbruscin, dkeler, dmayorov, dpaolell, dschmidt, eaguilar, ebaron, ehugonne, ewittman, flucifre, fmariani, ggrzybek, gmalinko, gmeno, gparvin, groman, hasun, janstey, jchui, jdelft, jfula, jhe, jlanda, jlledo, jmatsuok, jowilson, jprabhak, jraez, jtolenti, jupierce, jwong, jwon, kaycoth, kbempah, kshier, ktsao, kvanderr, lchilton, lgarciaa, mbenjamin, mbiarnes, mcarlett, mhackett, nboldt, nipatil, nyancey, oaljalju, omaciel, ometelka, pantinor, parichar, pjindal, ppalepu, ppostler, prdhamdh, psrna, ptisnovs, rhaigner, rhel-process-autobot, rkubis, rstepani, rushinde, sdawley, sfeifer, sghai, sidsharm, simaishi, solenoci, sostapov, stcannon, suppawar, syedriko, tasato, tcunning, teagle, thason, tsedmik, ttakamiy, vereddy, vlaad, watson-tool-maintainers, wtam, xdharmai, yfang, yguenane |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in DOMPurify. When configured to sanitize HTML templates for direct Document Object Model (DOM) output, the software fails to properly remove malicious template expressions. This allows an attacker to inject specially crafted input that bypasses the sanitization process. Consequently, a downstream template engine may evaluate these attacker-supplied expressions, which can lead to information disclosure or other unintended actions.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2515218, 2515220, 2515221, 2515222, 2515223, 2515226, 2515227, 2515219, 2515224, 2515225, 2515228, 2515229 | ||
| Bug Blocks: | |||
DOMPurify versions >=3.0.0 and before 3.4.8, when configured with SAFE_FOR_TEMPLATES together with a DOM output mode (RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE), fail to strip template expressions (e.g. ${evil}, {{evil}}, <%evil%>) inside <template> element content. The final normalization/scrub pass (_scrubTemplateExpressions) uses a NodeIterator and node.normalize() that do not descend into template.content, so expressions that only form after adjacent text nodes merge survive sanitization. This bypasses SAFE_FOR_TEMPLATES and can allow a downstream template engine to evaluate attacker-supplied expressions. The string output path is not affected.