DOMPurify versions >=3.0.0 and <3.4.8, when configured with SAFE_FOR_TEMPLATES and a DOM output mode (RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE), fail to properly neutralize template expressions such as ${evil}, {{evil}}, or <%evil%> inside <template> element content. The sanitization bypass occurs because the final normalization and scrub pass uses a NodeIterator and node.normalize() that do not descend into the template.content subtree, allowing attacker-controlled expressions that form after adjacent text nodes merge to survive. This bypass undermines the SAFE_FOR_TEMPLATES protection and can lead to execution of attacker-supplied expressions by downstream template engines. The string output path is unaffected by this vulnerability.

An attacker can inject template expressions inside <template> elements that are not sanitized, potentially leading to cross-site scripting (XSS) when the sanitized DOM is processed by a vulnerable downstream template engine. This can result in execution of arbitrary code in the context of the affected web application. The vulnerability is limited to specific DOM output modes combined with SAFE_FOR_TEMPLATES configuration and does not affect string output modes.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using DOMPurify versions >=3.0.0 and <3.4.8 with SAFE_FOR_TEMPLATES in combination with DOM output modes (RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE). Consider using string output modes or upgrading to a fixed version once released by the vendor.