CVE-2026-41239: DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode

April 22, 2026 (updated April 27, 2026)

Field	Value
Severity	Medium
Affected	DOMPurify `main` at `883ac15`, introduced in v1.0.10 (`7fc196db`)

SAFE_FOR_TEMPLATES strips {{...}} expressions from untrusted HTML. This works in string mode but not with RETURN_DOM or RETURN_DOM_FRAGMENT, allowing XSS via template-evaluating frameworks like Vue 2.

References

github.com/advisories/GHSA-crv5-9vww-q3g8
github.com/cure53/DOMPurify/releases/tag/3.4.0
github.com/cure53/DOMPurify/security/advisories/GHSA-crv5-9vww-q3g8
nvd.nist.gov/vuln/detail/CVE-2026-41239

Code Behaviors & Features

Detect and mitigate CVE-2026-41239 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →