6.1
MediumCVSS 3.1 · from VulnCheck
CVE-2026-116804
DOMPurify from 3.4.4 before 3.4.17 SAFE_FOR_TEMPLATES Bypass via Shadow Root Content
DOMPurify · Cross-site scripting · CWE-79AffectedDOMPurify
FixUpdate to 3.4.17 or newer
PublishedOct 26, 23:05 · VulnCheck
ScoredOct 26 · 6.1 · VulnCheck
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:11 UTC
What we know
No known exploitation. CISA KEV, checked 22:11 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
Someone has to open, click or run something first. CVSS: user interaction required.
Description
DOMPurify from 3.4.4 before 3.4.17 contains a SAFE_FOR_TEMPLATES bypass that lets attackers preserve template expressions in attached shadow roots when using RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE modes. Attackers can split expressions across text nodes separated by disallowed elements, which merge after removal and are evaluated by downstream template engines for cross-site scripting.
From VulnCheck
Affected and fixed versions
ProductAffectedFixed inDOMPurify3.4.4 – before 3.4.173.4.17DOMPurifyNot affected3.4.17
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known