CVE-2026-49978

UNKNOWN 0.0

DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.7, DOMPurify IN_PLACE sanitization could skip shadow contents attached to an element inside <template>.content, allowing attacker-controlled markup such as event handlers, JavaScript URLs, or scripts to survive and execute when an application cloned and inserted the sanitized template. This issue is fixed in version 3.4.7.

CWE	CWE-79
Vendor	cure53
Product	dompurify
Published	Jul 14, 2026

Stay Ahead of the Next One

Get instant alerts for cure53 dompurify

Be the first to know when new unknown vulnerabilities affecting cure53 dompurify are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

cure53 / DOMPurify

< 3.4.6

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/cure53/DOMPurify/security/advisories/GHSA-rp9w-3fw7-7cwq github.com: https://github.com/cure53/DOMPurify/commit/ca30f070c360df162a3e3848e80e6fd3c9e74bff github.com: https://github.com/cure53/DOMPurify/releases/tag/3.4.7