{"id":"CVE-2026-116804","kind":"vulnerability","aliases":["CVE-2026-116804"],"related":[],"title":"DOMPurify: SAFE_FOR_TEMPLATES bypass lets template expressions survive sanitization","description":"DOMPurify from 3.4.4 before 3.4.17 contains a SAFE_FOR_TEMPLATES bypass that lets attackers preserve template expressions in attached shadow roots when using RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE modes. Attackers can split expressions across text nodes separated by disallowed elements, which merge after removal and are evaluated by downstream template engines for cross-site scripting.","summary":"DOMPurify versions 3.4.4 up to 3.4.17 fail to strip template expressions split across text nodes when RETURN_DOM, RETURN_DOM_FRAGMENT or IN_PLACE is used. A downstream template engine can then evaluate the merged expression, which enables cross-site scripting.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dompurify","frontend","javascript","package","web-apps"],"not_affected_if":["default-config","no-template-engine"],"how_to_check":"- Check the installed version with `npm ls dompurify` or by reading `node_modules/dompurify/package.json`.\n- Search the code for `RETURN_DOM`, `RETURN_DOM_FRAGMENT` or `IN_PLACE` passed to `DOMPurify.sanitize`, and for `SAFE_FOR_TEMPLATES`.","fix":"- Upgrade `dompurify` to `3.4.17` or later.\n- If the upgrade is not possible, avoid the RETURN_DOM, RETURN_DOM_FRAGMENT and IN_PLACE modes on untrusted input, unknown for other workarounds.","status":"open","published_at":"2026-10-27T00:17:12+00:00","first_seen_at":"2026-10-27T00:25:55+00:00","triaged_at":"2026-10-27T00:26:37+00:00","updated_at":"2026-10-27T00:26:37+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-27T00:26:37Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `dompurify` to `3.4.17` or later.\n- If the upgrade is not possible, avoid the RETURN_DOM, RETURN_DOM_FRAGMENT and IN_PLACE modes on untrusted input, unknown for other workarounds.","reach":"internet","title":"DOMPurify: SAFE_FOR_TEMPLATES bypass lets template expressions survive sanitization","impact":"medium","summary":"DOMPurify versions 3.4.4 up to 3.4.17 fail to strip template expressions split across text nodes when RETURN_DOM, RETURN_DOM_FRAGMENT or IN_PLACE is used. A downstream template engine can then evaluate the merged expression, which enables cross-site scripting.","category":"package","nicknames":[],"who_cares":["javascript","frontend","dompurify","web-apps"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker injects script through template expressions, enabling cross-site scripting","analyst_note":"Check the NVD entry and the DOMPurify advisory for which template engines evaluate the output and for any workaround short of upgrading.","how_to_check":"- Check the installed version with `npm ls dompurify` or by reading `node_modules/dompurify/package.json`.\n- Search the code for `RETURN_DOM`, `RETURN_DOM_FRAGMENT` or `IN_PLACE` passed to `DOMPurify.sanitize`, and for `SAFE_FOR_TEMPLATES`.","needs_analyst":true,"not_affected_if":["default-config","no-template-engine"],"who_is_affected":"Applications that use DOMPurify 3.4.4 through 3.4.17 with one of the DOM-returning modes (RETURN_DOM, RETURN_DOM_FRAGMENT, IN_PLACE) and that feed the sanitized output into a client-side template engine. Applications that use the default string output or do not use a template engine on the output are less likely to be exposed. The sources do not say which template engines are affected.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000715,"input_tokens":3391,"output_tokens":752,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116804':13A,16A '-2026':12A,15A '3.4.17':29B,70C '3.4.4':26B,68C 'across':36B,102C 'app':23B 'attach':84C 'attack':79C,98C 'bypass':5A,76C 'contain':71C 'cross':63B,122C 'cross-sit':62B,121C 'cve':11A,14A 'disallow':107C 'dom':41B,43B,90C,92C 'dompurifi':1A,17B,24B,66C 'downstream':51B,117C 'element':108C 'enabl':61B 'engin':53B,119C 'evalu':56B,115C 'express':8A,34B,59B,82C,101C 'fail':30B 'fragment':44B,93C 'frontend':18B 'javascript':19B 'let':6A,78C 'merg':58B,110C 'mode':97C 'node':38B,104C 'packag':20B 'place':47B,96C 'preserv':80C 'remov':112C 'return':40B,42B,89C,91C 'root':86C 'safe':2A,73C 'sanit':10A 'script':65B,124C 'separ':105C 'shadow':85C 'site':64B,123C 'split':35B,100C 'strip':32B 'surviv':9A 'templat':4A,7A,33B,52B,75C,81C,118C 'text':37B,103C 'use':49B,88C 'version':25B 'web':22B 'web-app':21B","nicknames":[],"mitigations":[],"who_affected":"Applications that use DOMPurify 3.4.4 through 3.4.17 with one of the DOM-returning modes (RETURN_DOM, RETURN_DOM_FRAGMENT, IN_PLACE) and that feed the sanitized output into a client-side template engine. Applications that use the default string output or do not use a template engine on the output are less likely to be exposed. The sources do not say which template engines are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T00:17:12+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116804","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116804","severity":null,"published_at":"2026-10-27T00:17:12+00:00","modified_at":"2026-10-27T00:17:12+00:00","first_seen_at":"2026-10-27T00:25:55+00:00","fetched_at":"2026-10-27T00:25:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}