CVE-2026-49978CWE-79

DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content

Medium · published July 14, 2026

CVSS v4.0
6.3
EPSS
0%
Percentile
33.5
In the wild
Unconfirmed
What it is

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.7, DOMPurify IN_PLACE sanitization could skip shadow contents attached to an element inside <template>.content, allowing attacker-controlled markup such as event handlers, JavaScript URLs, or scripts to survive and execute when an application cloned and inserted the sanitized template. This issue is fixed in version 3.4.7.

The record
Technical detail
CVSS v4.0
6.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
EPSS
0.00404 · 33.5th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-07-14T20:02Z
EPSS history
Timeline
  • 14 JUL 20:02Z
    DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content
    cvelistv5