Live › vulnerability › CVE-2026-116804
Go to dashboardDOMPurify versions 3.4.4 up to 3.4.17 fail to strip template expressions split across text nodes when RETURN_DOM, RETURN_DOM_FRAGMENT or IN_PLACE is used. A downstream template engine can then evaluate the merged expression, which enables cross-site scripting.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 00:25 UTC. All times on this page are UTC.
Applications that use DOMPurify 3.4.4 through 3.4.17 with one of the DOM-returning modes (RETURN_DOM, RETURN_DOM_FRAGMENT, IN_PLACE) and that feed the sanitized output into a client-side template engine. Applications that use the default string output or do not use a template engine on the output are less likely to be exposed. The sources do not say which template engines are affected.
No product ranges from the sources yet.
npm ls dompurify or by reading node_modules/dompurify/package.json.RETURN_DOM, RETURN_DOM_FRAGMENT or IN_PLACE passed to DOMPurify.sanitize, and for SAFE_FOR_TEMPLATES.dompurify to 3.4.17 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
DOMPurify from 3.4.4 before 3.4.17 contains a SAFE_FOR_TEMPLATES bypass that lets attackers preserve template expressions in attached shadow roots when using RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE modes. Attackers can split expressions across text nodes separated by disallowed elements, which merge after removal and are evaluated by downstream template engines for cross-site scripting.
This page as .md · .json · in your agent: get_signal("CVE-2026-116804")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.