CVE-2026-79320

Name of the Vulnerable Software and Affected Versions Stencil core version 4.43.5

Description A DOM-based cross-site scripting (XSS) issue exists in the component runtime. When a downstream application enables the experimental slot fixes option and utilizes scoped components, assigning a string to the textContent property of a component's host element results in the value being parsed as HTML rather than being inserted as plain text. This allows attacker-controlled data written to these host elements to be interpreted as markup, leading to script execution within the application's origin.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.