https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-29T10:38:15.829377+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-41239 CVE-2026-41239 — DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode 2026-09-29T10:38:15.832036+00:00

Affected: cure53 DOMPurify

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Starting in version 1.0.10 and prior to version 3.4.0, `SAFE_FOR_TEMPLATES` strips `{{...}}` expressions from untrusted HTML. This works in string mode but not with `RETURN_DOM` or `RETURN_DOM_FRAGMENT`, allowing XSS via template-evaluating frameworks like Vue 2. Version 3.4.0 patches the issue.