AIKIDO-2026-11156

TL;DR

When DOMPurify.sanitize runs with SAFE_FOR_TEMPLATES together with RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE, attacker HTML inside a template element can keep split template-literal, mustache, or ERB fragments in template.content. The final _scrubTemplateExpressions pass never entered template.content, so adjacent text nodes that only form expressions after normalization could survive. Downstream template evaluation or normalization can then execute the recovered expression as script. The fix recurses _scrubTemplateExpressions into each template.content, mirroring shadow-DOM traversal.