CVE-2026-79320: XSS
Stencil core 4.43.5 contains a DOM-based cross-site scripting (XSS) vulnerability in the component runtime. When a downstream application enables the experimental slot fixes option and uses scoped components, assigning a string to the textContent property of such a component's host element causes the value to be parsed as HTML instead of being inserted as text. If an application writes attacker-controlled data to these host elements, the data can be interpreted as markup and script can execute in the context of the application's origin.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
stencil coreto a version that resolves this vulnerability.Fixed in 4.43.5 - Configuration
Disable the experimental slot fixes option in downstream applications when using scoped components, since it causes attacker-controlled data assigned to the host element’s textContent to be parsed as HTML instead of inserted as text.
Stencil component runtime (experimental slot fixes option + scoped components) experimental slot fixes option = disable - Compensating control
If attacker-controlled data could be written to host elements, ensure that any HTML/script execution is prevented by using a compensating control appropriate for your environment (e.g., restrict execution or add isolation) until the underlying Stencil DOM-based XSS behavior is corrected.
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Exposure requires all of the following: Stencil core 4.43.5, the experimental slot fixes option enabled, and use of scoped components. The application must also assign attacker-controlled strings to the textContent property of a scoped component's host element.
What does an attacker need to exploit the vulnerability?
An attacker needs a way to influence data that the application writes to the affected host element's textContent property. The injected value is then parsed as HTML and may execute script in the application's origin.
Are default Stencil configurations affected?
The issue is described as requiring the experimental slot fixes option, so applications that have not enabled that option are not described as affected. Scoped components are also required.
What can be done if updating is not immediately possible?
Avoid assigning untrusted strings to textContent on hosts of scoped components while the experimental slot fixes option is enabled. Disable that option or avoid the affected scoped-component pattern where feasible.