CVE-2026-116804 in DOMPurify
Summary
by MITRE • 10/27/2026
DOMPurify from 3.4.4 before 3.4.17 contains a SAFE_FOR_TEMPLATES bypass that lets attackers preserve template expressions in attached shadow roots when using RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE modes. Attackers can split expressions across text nodes separated by disallowed elements, which merge after removal and are evaluated by downstream template engines for cross-site scripting.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/27/2026
The vulnerability identified within DOMPurify versions prior to 3.4.17 represents a significant security flaw in the library's sanitization logic, specifically affecting operations that utilize RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE modes while operating under SAFE_FOR_TEMPLATES settings. This configuration is typically employed when developers intend to insert sanitized HTML into JavaScript template engines such as AngularJS, Vue.js, or React, which may interpret certain syntax patterns as executable code rather than static text content. The core technical flaw lies in the library's inability to correctly handle complex DOM structures involving attached shadow roots during the sanitization process. When an attacker injects malicious payloads that leverage these specific output modes, the sanitizer fails to properly isolate and neutralize template expressions embedded within or associated with shadow root boundaries. This oversight allows potentially dangerous script execution contexts to persist in the sanitized output, bypassing the intended safety guarantees of the SAFE_FOR_TEMPLATES flag which is designed specifically to prevent such code injection scenarios.
From a technical perspective, the exploitation mechanism relies on the manipulation of DOM node structures and text content merging behaviors inherent to how browsers process HTML fragments. Attackers can craft payloads that split malicious template expressions across multiple distinct text nodes. These nodes are strategically separated by elements that are deemed disallowed or unsafe by the sanitizer's configuration rules. During the sanitization phase, these intervening disallowed elements are removed from the DOM tree. However, due to how the browser and subsequent JavaScript engines handle adjacent text nodes in certain contexts, the remaining parts of the split expression merge back together into a single continuous string. This merged content retains its syntactic validity as a template expression, effectively reconstructing the malicious payload that was originally fragmented. Because this merging occurs after or during the sanitization process but before the final output is returned to the application logic, the resulting DOM structure contains executable code fragments that were not present in their complete form within the raw input string processed by the sanitizer's initial ruleset.
The operational impact of this vulnerability is severe, as it directly facilitates Cross-Site Scripting attacks against applications relying on template engines for rendering dynamic content. Once the sanitized HTML containing these preserved template expressions is inserted into the page and rendered, downstream JavaScript frameworks evaluate them according to their respective syntax specifications. If an attacker can control any part of the data bound within these templates, they may achieve arbitrary code execution within the victim's browser session. This could lead to full account compromise through session hijacking, theft of sensitive user data such as credentials or personal information, defacement of the application interface, or even pivoting to further attacks against backend systems if client-side actions trigger server-side requests with malicious parameters. The severity is compounded by the fact that developers often rely on DOMPurify's SAFE_FOR_TEMPLATES mode precisely because they believe it provides a higher level of security for template-based rendering contexts, making this bypass particularly deceptive and dangerous in production environments where such configurations are standard practice.
This vulnerability aligns with CWE-79, which covers Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting, specifically highlighting the failure to neutralize special elements that could be interpreted as executable code by downstream processors. Furthermore, it maps to MITRE ATT&CK technique T1059, Command and Scripting Interpreter, where attackers use scripting languages like JavaScript to execute commands or perform actions on behalf of a user. The specific mechanism of splitting payloads across nodes also relates to CWE-642, External Control of Critical State Variable, as the manipulation of DOM structure alters the state in which data is interpreted by subsequent code execution contexts. To mitigate this risk, organizations must immediately upgrade DOMPurify to version 3.4.17 or later where these bypasses have been addressed through improved handling of shadow root boundaries and stricter enforcement of template expression isolation rules. Additionally, developers should implement Content Security Policy headers with strict script-src directives that restrict the execution of inline scripts and eval-like functions wherever possible, providing a secondary layer of defense against any residual injection attempts. Regular security audits of sanitization configurations are also recommended to ensure that output modes like RETURN_DOM or IN_PLACE are used only when strictly necessary and paired with appropriate validation layers at the application logic level.