All vulnerabilities
CVE-2026-116804GHSA-cg2g-xh64-v4q7

DOMPurify from 3.4.4 before 3.4.17 SAFE_FOR_TEMPLATES Bypass via Shadow Root Content

cure53 DOMPurifynpmLibraries & packages
Open in ThreatlineRecord JSON
CVSS
5.1Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in3.4.17Fixed versionCVE List
Published26 Oct 2026Updated 26 Oct 2026CVE List

What fixes it

  • 3.4.17DOMPurifyCVE List
  • 3.4.17dompurify, npmOSVnpm install dompurify@3.4.17

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

DOMPurify from 3.4.4 before 3.4.17 contains a SAFE_FOR_TEMPLATES bypass that lets attackers preserve template expressions in attached shadow roots when using RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE modes. Attackers can split expressions across text nodes separated by disallowed elements, which merge after removal and are evaluated by downstream template engines for cross-site scripting.

Text from CVE List

Affected versions 3

  • DOMPurifyaffected: 3.4.4 before 3.4.17CVE List
  • DOMPurifyunaffected: 3.4.17CVE List
  • dompurify, npmfrom 3.4.4, fixed in 3.4.17OSV

References 2