CVE-2026-49978: DOMPurify Sanitization Bypass via Shadow DOM in <template>
Summary
CVE-2026-49978: DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside .content. Affects dompurify versions < 3.4.7. Fixed in 3.4.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
DOMPurify is a popular JavaScript library used to sanitize HTML and prevent XSS attacks. It is widely utilized in web applications to ensure that user-generated content is safe for rendering. The library is designed to remove potentially harmful scripts and attributes from HTML, making it a critical component for web security. However, a vulnerability has been identified that allows attackers to bypass the sanitization process when using shadow DOM elements within <template> tags.
Vulnerability Detail
The vulnerability arises when HTML containing a <template> element is processed by DOMPurify. If there is an element with an attached shadow DOM inside the template, DOMPurify fails to sanitize the contents of the shadow DOM. This oversight allows attackers to insert malicious payloads, such as scripts or links with javascript: URLs, which remain intact and execute when the template is used. The implications of this vulnerability are severe, as it can lead to XSS attacks, allowing attackers to steal session cookies, tokens, and perform actions on behalf of users.
How To Fix
Latest published version: 3.4.17 as of 22 Oct 2026
npm install dompurify@3.4.17Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.4.7
This is the first release that contains the fix.
npm install dompurify@3.4.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using shadow DOM elements within <template> tags when working with DOMPurify. This will help mitigate the risk of the vulnerability until you can update to the patched version.
Conclusion
The DOMPurify vulnerability CVE-2026-49978 highlights a critical issue in the sanitization process when using shadow DOM elements within <template> tags. It is essential for developers to update to the latest version of the library to protect their applications from potential XSS attacks. Utilizing tools like Vulert can help monitor and identify vulnerabilities in real-time.
See every vulnerability recorded for dompurify →
FAQ
The CVSS score of this vulnerability is 5.1, indicating a moderate level of risk.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application using the Vulert playground at Vulert Scanner without any signup.
Exploitation of this vulnerability can lead to XSS attacks, allowing attackers to steal sensitive information such as session cookies and tokens.
Yes, version 3.4.7 and later of DOMPurify addresses this vulnerability and is safe to use.
If you cannot update the package right away, avoid using shadow DOM elements within <template> tags as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for dompurify.
