CVE-2026-116804: DOMPurify from 3.4.4 before 3.4.17 SAFE_FOR_TEMPLATES Bypass via Shadow Root Content

Q: Which applications are exposed to this issue?

Applications using DOMPurify versions 3.4.4 through before 3.4.17 are exposed when they enable SAFE_FOR_TEMPLATES and sanitize untrusted content with RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE. The risk is relevant when the resulting DOM is later processed by a template engine.

Q: What does an attacker need to exploit it?

An attacker needs a way to supply crafted content that is sanitized by the affected configuration and then reaches a downstream template engine. The payload splits template expressions across text nodes separated by disallowed elements, so the expression is reassembled after those elements are removed.

Q: Is user interaction required?

Yes. The supplied vector indicates user interaction is required, although the available data does not specify what form that interaction takes.

Q: How can I determine whether an application is affected?

Check whether the application uses npm/dompurify at a version from 3.4.4 through before 3.4.17, enables SAFE_FOR_TEMPLATES, and uses RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE. Also determine whether sanitized output can be passed to a template engine, particularly where attached shadow-root content is retained.

Published Oct 26, 2026

Updated

DOMPurify from 3.4.4 before 3.4.17 contains a SAFEFORTEMPLATES bypass that lets attackers preserve template expressions in attached shadow roots when using RETURNDOM, RETURNDOMFRAGMENT, or INPLACE modes. Attackers can split expressions across text nodes separated by disallowed elements, which merge after removal and are evaluated by downstream template engines for cross-site scripting.

Affected Software

1 affected component

npm/dompurify>=3.4.4<3.4.17

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade DOMPurify to a version that resolves this vulnerability.
Fixed in 3.4.17

Event History

Oct 26, 2026

CVE Published

via MITRE·11:05 PM

Data Sourced

via MITRE·11:05 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which applications are exposed to this issue?

Applications using DOMPurify versions 3.4.4 through before 3.4.17 are exposed when they enable SAFE_FOR_TEMPLATES and sanitize untrusted content with RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE. The risk is relevant when the resulting DOM is later processed by a template engine.

What does an attacker need to exploit it?

An attacker needs a way to supply crafted content that is sanitized by the affected configuration and then reaches a downstream template engine. The payload splits template expressions across text nodes separated by disallowed elements, so the expression is reassembled after those elements are removed.

Is user interaction required?

Yes. The supplied vector indicates user interaction is required, although the available data does not specify what form that interaction takes.

How can I determine whether an application is affected?

Check whether the application uses npm/dompurify at a version from 3.4.4 through before 3.4.17, enables SAFE_FOR_TEMPLATES, and uses RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE. Also determine whether sanitized output can be passed to a template engine, particularly where attached shadow-root content is retained.

CVE-2026-116804: DOMPurify from 3.4.4 before 3.4.17 SAFE_FOR_TEMPLATES Bypass via Shadow Root Content

Affected Software

Remediation

Event History

Frequently Asked Questions

Which applications are exposed to this issue?

What does an attacker need to exploit it?

Is user interaction required?

How can I determine whether an application is affected?

Company

Resources

Contact

Frequently Asked Questions

Which applications are exposed to this issue?

What does an attacker need to exploit it?

Is user interaction required?

How can I determine whether an application is affected?