DOMPurify from 3.4.4 before 3.4.17 SAFE_FOR_TEMPLATES Bypass via Shadow Root Content

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-116804 · Microsoft / collected KEV context

EUVD-2026-110512

GHSA-6vxf-252m-8g79

GHSA-cg2g-xh64-v4q7

cve-program · CVE-2026-116804

• https://github.com/cure53/DOMPurify/security/advisories/GHSA-cg2g-xh64-v4q7
• https://www.vulncheck.com/advisories/dompurify-from-3.4.4-before-3.4.17-safe-for-templates-bypass-via-shadow-root-content

euvd · EUVD-2026-110512

• https://github.com/cure53/DOMPurify/security/advisories/GHSA-cg2g-xh64-v4q7
• https://www.vulncheck.com/advisories/dompurify-from-3.4.4-before-3.4.17-safe-for-templates-bypass-via-shadow-root-content

nvd · CVE-2026-116804

• https://github.com/cure53/DOMPurify/security/advisories/GHSA-cg2g-xh64-v4q7
• https://www.vulncheck.com/advisories/dompurify-from-3.4.4-before-3.4.17-safe-for-templates-bypass-via-shadow-root-content

osv · GHSA-cg2g-xh64-v4q7

• https://github.com/cure53/DOMPurify/security/advisories/GHSA-cg2g-xh64-v4q7
• https://github.com/cure53/DOMPurify/pull/1672
• https://github.com/cure53/DOMPurify/commit/a77a3e78b59f72fa4d1c83f22e121ad9cc7d3575
• https://github.com/cure53/DOMPurify
• https://github.com/cure53/DOMPurify/releases/tag/3.4.17

• DOMPurify from 3.4.4 before 3.4.17 contains a SAFE_FOR_TEMPLATES bypass that lets attackers preserve template expressions in attached shadow roots when using RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE modes. Attackers can split expression… · Advisory content revised · 29 Oct 2026
• DOMPurify from 3.4.4 before 3.4.17 SAFE_FOR_TEMPLATES Bypass via Shadow Root Content · Newly collected advisory · 27 Oct 2026
• DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes · Advisory content revised · 27 Oct 2026