{"id":"EUVD-2026-110512","enisaUuid":"1dcec15e-7664-3ac4-a0ac-daba42764070","description":"DOMPurify from 3.4.4 before 3.4.17 contains a SAFE_FOR_TEMPLATES bypass that lets attackers preserve template expressions in attached shadow roots when using RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE modes. Attackers can split expressions across text nodes separated by disallowed elements, which merge after removal and are evaluated by downstream template engines for cross-site scripting.","datePublished":"Oct 26, 2026, 11:05:35 PM","dateUpdated":"Oct 26, 2026, 11:05:35 PM","baseScore":5.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","references":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-cg2g-xh64-v4q7\nhttps://www.vulncheck.com/advisories/dompurify-from-3.4.4-before-3.4.17-safe-for-templates-bypass-via-shadow-root-content\n","aliases":"CVE-2026-116804\nGHSA-6vxf-252m-8g79\n","assigner":"VulnCheck","epss":0.18,"enisaIdProduct":[{"id":"3d9f5ebd-e4eb-3ef6-b244-d94f81b23727","product":{"name":"DOMPurify","vendor":{"name":"cure53"}},"product_version":"3.4.4 \u003c3.4.17"}],"enisaIdVendor":[{"id":"2a1d7def-e7ee-3443-ad0c-f03765ad56e2","vendor":{"name":"cure53"}}],"enisaIdVulnerability":[{"id":"95118118-b8cf-3d0f-b3a5-af69041191bf","vulnerability":{"id":"GHSA-6vxf-252m-8g79","description":"DOMPurify from 3.4.4 before 3.4.17 contains a SAFE_FOR_TEMPLATES bypass that lets attackers preserve template expressions in attached shadow roots when using RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE modes. Attackers can split expressions across text nodes separated by disallowed elements, which merge after removal and are evaluated by downstream template engines for cross-site scripting.","datePublished":"Oct 27, 2026, 12:32:51 AM","dateUpdated":"Oct 27, 2026, 12:32:51 AM","baseScore":0.0,"references":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-cg2g-xh64-v4q7\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-116804\nhttps://www.vulncheck.com/advisories/dompurify-from-3.4.4-before-3.4.17-safe-for-templates-bypass-via-shadow-root-content\n","enisa_id":"EUVD-2026-110512\n","aliases":"GHSA-6vxf-252m-8g79\nCVE-2026-116804\n","epss":0.0,"dataProcessed":"Oct 29, 2026, 11:01:28 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"f3e1a9d0-d0a4-32b0-8a20-6c14d6bd3c47","vulnerability":{"id":"CVE-2026-116804","description":"DOMPurify from 3.4.4 before 3.4.17 contains a SAFE_FOR_TEMPLATES bypass that lets attackers preserve template expressions in attached shadow roots when using RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE modes. Attackers can split expressions across text nodes separated by disallowed elements, which merge after removal and are evaluated by downstream template engines for cross-site scripting.","datePublished":"Oct 26, 2026, 11:05:35 PM","dateUpdated":"Oct 26, 2026, 11:05:35 PM","status":"PUBLISHED","baseScore":5.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","references":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-cg2g-xh64-v4q7\nhttps://www.vulncheck.com/advisories/dompurify-from-3.4.4-before-3.4.17-safe-for-templates-bypass-via-shadow-root-content\n","enisa_id":"EUVD-2026-110512\n","assigner":"VulnCheck","epss":0.18,"dataProcessed":"Oct 29, 2026, 7:15:08 AM","vulnerabilityProduct":[{"id":"0497a7fc-5597-345a-ad65-e46e04e79a45","product":{"name":"DOMPurify","vendor":{"name":"cure53"}},"product_version":"3.4.4 \u003c3.4.17"}],"vulnerabilityVendor":[{"id":"2fb968bc-5ba1-3b28-ba8f-bee15dda8c92","vendor":{"name":"cure53"}}]}}],"enisaIdAdvisory":[]}