Medium severity6.1NVD Advisory· Published Oct 27, 2026

CVE-2026-116804

Description

DOMPurify from 3.4.4 before 3.4.17 contains a SAFE_FOR_TEMPLATES bypass that lets attackers preserve template expressions in attached shadow roots when using RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE modes. Attackers can split expressions across text nodes separated by disallowed elements, which merge after removal and are evaluated by downstream template engines for cross-site scripting.

Affected products

Cure53/Dompurifyllm-fuzzy
Range: >=3.4.4 <3.4.17

Patches

Vulnerability mechanics

References

github.com/cure53/DOMPurify/security/advisories/GHSA-cg2g-xh64-v4q7nvd
www.vulncheck.com/advisories/dompurify-from-3.4.4-before-3.4.17-safe-for-templates-bypass-via-shadow-root-contentnvd

News mentions

No linked articles in our index yet.

cvss	0.397
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000