DOMPurify is a sanitizer for HTML, MathML, and SVG to prevent XSS attacks. In versions >=1.0.10 and <3.4.0, the SAFE_FOR_TEMPLATES option intended to remove template expressions ({{...}}) from untrusted HTML works only in string output mode. When DOMPurify is used with RETURN_DOM or RETURN_DOM_FRAGMENT modes, these expressions are not stripped, enabling XSS attacks in frameworks that evaluate templates such as Vue 2. This vulnerability is addressed in DOMPurify version 3.4.0.

Successful exploitation allows an attacker to inject malicious scripts via untrusted HTML that includes template expressions, leading to cross-site scripting attacks. This can result in the execution of arbitrary JavaScript in the context of the victim's browser, potentially compromising confidentiality and integrity of user data. The CVSS score is 6.8 (medium severity), reflecting network attack vector, high impact on confidentiality and integrity, but requiring user interaction and high attack complexity.

Upgrade DOMPurify to version 3.4.0 or later, where this vulnerability is patched. There is no official fix or patch available for earlier versions. Until upgrading, avoid using RETURN_DOM or RETURN_DOM_FRAGMENT modes with SAFE_FOR_TEMPLATES enabled in untrusted contexts. Patch status is not explicitly stated beyond the version 3.4.0 fix; check the vendor's advisory for the latest remediation guidance.