https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 04:07:59 +0000 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1049 certfr-2026-avi-1049 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1049 https://cve.radiocsirt.org/vuln/euvd-2026-340294 EUVD-2026-340294 https://cve.radiocsirt.org/vuln/euvd-2026-340294 https://cve.radiocsirt.org/vuln/fkie_cve-2026-65900 <p>DOMPurify versions &gt;=3.0.0 and before 3.4.8, when configured with SAFE_FOR_TEMPLATES together with a DOM output mode (RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE), fail to strip template expressions (e.g. ${evil}, {{evil}}, &lt;%evil%&gt;) inside &lt;template&gt; element content. The final normalization/scrub pass (_scrubTemplateExpressions) uses a NodeIterator and node.normalize() that do not descend into template.content, so expressions that only form after adjacent text nodes merge survive sanitization. This bypasses SAFE_FOR_TEMPLATES and can allow a downstream template engine to evaluate attacker-supplied expressions. The string output path is not affected.</p> <p>DOMPurify versions &gt;=3.0.0 and before 3.4.8, when configured with SAFE_FOR_TEMPLATES together with a DOM output mode (RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE), fail to strip template expressions (e.g. ${evil}, {{evil}}, &lt;%evil%&gt;) inside &lt;template&gt; element content. The final normalization/scrub pass (_scrubTemplateExpressions) uses a NodeIterator and node.normalize() that do not descend into template.content, so expressions that only form after adjacent text nodes merge survive sanitization. This bypasses SAFE_FOR_TEMPLATES and can allow a downstream template engine to evaluate attacker-supplied expressions. The string output path is not affected.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-65900 https://cve.radiocsirt.org/vuln/ghsa-gvmj-g25r-r7wr <p><strong>Affected:</strong> npm: dompurify</p> <p>## Summary</p> <p>When DOMPurify is configured with both `SAFE_FOR_TEMPLATES: true` and `RETURN_DOM: true` (or `IN_PLACE: true`), an attacker can inject template expressions, such as `${evil}`, `{{evil}}`, or `&lt;%evil%&gt;`, that survive the sanitization pass inside `&lt;template&gt;` element content. This bypasses the explicit purpose of `SAFE_FOR_TEMPLATES`, which is to prevent template engine evaluation of user-supplied content.</p> <p>&gt; **Note:** The string output path is **not** affected. Only the DOM return paths (`RETURN_DOM: true`, `RETURN_DOM_FRAGMENT: true`, `IN_PLACE: true`) are vulnerable.</p> <p>---</p> <p>## Description</p> <p>### Background</p> <p>`SAFE_FOR_TEMPLATES` is designed to strip `{{ }}`, `${ }`, and `&lt;% %&gt;` expressions from sanitized output so that downstream template engines do not evaluate user-controlled content. The feature operates through two mechanisms:</p> <p>1. **Per-node scrubbing** (`_sanitizeElements`, `src/purify.ts:1403`), scrubs individual text nodes during the main sanitization walk. 2. **Final normalization pass** (`_scrubTemplateExpressions`, `src/purify.ts:1115`), calls `node.normalize()` to merge adjacent text nodes, then walks the merged nodes and strips any expressions that only appeared after merging.</p> <p>### The Gap</p> <p>`_scrubTemplateExpressions` uses a standard `NodeIterator` rooted at the output body:</p> <p>```ts // src/purify.ts:1117 const walker = createNodeIterator.call( node.ownerDocument || node, node, NodeFilter.SHOW_TEXT | NodeFilter.SHOW_COMMENT | ..., null ); ```</p> <p>Per…</p> <p><strong>Affected:</strong> npm: dompurify</p> <p>## Summary</p> <p>When DOMPurify is configured with both `SAFE_FOR_TEMPLATES: true` and `RETURN_DOM: true` (or `IN_PLACE: true`), an attacker can inject template expressions, such as `${evil}`, `{{evil}}`, or `&lt;%evil%&gt;`, that survive the sanitization pass inside `&lt;template&gt;` element content. This bypasses the explicit purpose of `SAFE_FOR_TEMPLATES`, which is to prevent template engine evaluation of user-supplied content.</p> <p>&gt; **Note:** The string output path is **not** affected. Only the DOM return paths (`RETURN_DOM: true`, `RETURN_DOM_FRAGMENT: true`, `IN_PLACE: true`) are vulnerable.</p> <p>---</p> <p>## Description</p> <p>### Background</p> <p>`SAFE_FOR_TEMPLATES` is designed to strip `{{ }}`, `${ }`, and `&lt;% %&gt;` expressions from sanitized output so that downstream template engines do not evaluate user-controlled content. The feature operates through two mechanisms:</p> <p>1. **Per-node scrubbing** (`_sanitizeElements`, `src/purify.ts:1403`), scrubs individual text nodes during the main sanitization walk. 2. **Final normalization pass** (`_scrubTemplateExpressions`, `src/purify.ts:1115`), calls `node.normalize()` to merge adjacent text nodes, then walks the merged nodes and strips any expressions that only appeared after merging.</p> <p>### The Gap</p> <p>`_scrubTemplateExpressions` uses a standard `NodeIterator` rooted at the output body:</p> <p>```ts // src/purify.ts:1117 const walker = createNodeIterator.call( node.ownerDocument || node, node, NodeFilter.SHOW_TEXT | NodeFilter.SHOW_COMMENT | ..., null ); ```</p> <p>Per…</p> https://cve.radiocsirt.org/vuln/ghsa-gvmj-g25r-r7wr https://cve.radiocsirt.org/vuln/opensuse-su-2026:11723-1 <p>python313-comfyui-frontend-package-1.52.7-1.1 on GA media</p> <p>python313-comfyui-frontend-package-1.52.7-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:11723-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-65900 <p><strong>Affected:</strong> Ubuntu:22.04:LTS: node-dompurify, Ubuntu:24.04:LTS: node-dompurify, Ubuntu:26.04:LTS: node-dompurify</p> <p>DOMPurify versions &gt;=3.0.0 and before 3.4.8, when configured with SAFE_FOR_TEMPLATES together with a DOM output mode (RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE), fail to strip template expressions (e.g. ${evil}, {{evil}}, &lt;%evil%&gt;) inside &lt;template&gt; element content. The final normalization/scrub pass (_scrubTemplateExpressions) uses a NodeIterator and node.normalize() that do not descend into template.content, so expressions that only form after adjacent text nodes merge survive sanitization. This bypasses SAFE_FOR_TEMPLATES and can allow a downstream template engine to evaluate attacker-supplied expressions. The string output path is not affected.</p> <p><strong>Affected:</strong> Ubuntu:22.04:LTS: node-dompurify, Ubuntu:24.04:LTS: node-dompurify, Ubuntu:26.04:LTS: node-dompurify</p> <p>DOMPurify versions &gt;=3.0.0 and before 3.4.8, when configured with SAFE_FOR_TEMPLATES together with a DOM output mode (RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE), fail to strip template expressions (e.g. ${evil}, {{evil}}, &lt;%evil%&gt;) inside &lt;template&gt; element content. The final normalization/scrub pass (_scrubTemplateExpressions) uses a NodeIterator and node.normalize() that do not descend into template.content, so expressions that only form after adjacent text nodes merge survive sanitization. This bypasses SAFE_FOR_TEMPLATES and can allow a downstream template engine to evaluate attacker-supplied expressions. The string output path is not affected.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-65900