DOMPurify 3.4.7: IN_PLACE Sanitize Skips Shadow in <template>
CVE-2026-49978 Published on July 14, 2026

DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content
DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.7, DOMPurify IN_PLACE sanitization could skip shadow contents attached to an element inside <template>.content, allowing attacker-controlled markup such as event handlers, JavaScript URLs, or scripts to survive and execute when an application cloned and inserted the sanitized template. This issue is fixed in version 3.4.7.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-49978 is exploitable with network access. This vulnerability is considered to have a low attack complexity. Public availability of a proof of concept (POC) exploit exists for CVE-2026-49978. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
ACTIVE

Weakness Type

What is a XSS Vulnerability?

The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVE-2026-49978 has been classified to as a XSS vulnerability or weakness.


Products Associated with CVE-2026-49978

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2026-49978 are published in these products:

Cure53 Dompurify
 
Red Hat Kafka
 
Oracle
 

Affected Versions

cure53 DOMPurify Version < 3.4.6 is affected by CVE-2026-49978

Exploit Probability

EPSS
0.33%
Percentile
25.86%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.