CVE-2026-116804

Name of the Vulnerable Software and Affected Versions DOMPurify versions 3.4.4 through 3.4.16

Description A bypass of the SAFE FOR TEMPLATES configuration allows attackers to preserve template expressions within attached shadow roots. This occurs when using RETURN DOM, RETURN DOM FRAGMENT, or IN PLACE modes. Attackers can split expressions across text nodes separated by disallowed elements; these elements are removed, causing the text nodes to merge and the resulting expressions to be evaluated by downstream template engines, leading to cross-site scripting (XSS).

Recommendations Update DOMPurify to version 3.4.17 or later.