CVE-2026-49978
published 2026-07-14CVE-2026-49978: DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.7, DOMPurify IN_PLACE sanitization could skip shadow contents…
PriorityP426medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.40%
33.5th percentile
DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.7, DOMPurify IN_PLACE sanitization could skip shadow contents attached to an element inside .content, allowing attacker-controlled markup such as event handlers, JavaScript URLs, or scripts to survive and execute when an application cloned and inserted the sanitized template. This issue is fixed in version 3.4.7.
Affected
46 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| advanced-cluster-security | rhacs-main-rhel8 | — | — |
| advanced-cluster-security | rhacs-main-rhel9 | — | — |
| ansible-automation-platform-26 | gateway-rhel9 | — | — |
| ansible-automation-platform-27 | gateway-rhel9 | — | — |
| ansible-automation-platform | automation-portal | — | — |
| container-native-virtualization | kubevirt-console-plugin | — | — |
| container-native-virtualization | kubevirt-console-plugin-rhel9 | — | — |
| cure53 | dompurify | < 3.4.6 | 3.4.6 |
| cure53 | dompurify | < 3.4.7 | 3.4.7 |
| cure53 | dompurify | — | — |
| cure53 | dompurify | >= 0 < 3.4.7 | 3.4.7 |
| devspaces | code-rhel9 | — | — |
| devspaces | openvsx-rhel9 | — | — |
| migration-toolkit-virtualization | mtv-console-plugin-rhel9 | — | — |
| multicluster-engine | console-mce-rhel9 | — | — |
| odf4 | ocs-client-console-rhel9 | — | — |
| odf4 | odf-console-rhel9 | — | — |
| odf4 | odf-multicluster-console-rhel9 | — | — |
| openshift-gitops-1 | argocd-rhel8 | — | — |
| openshift-gitops-1 | argocd-rhel9 | — | — |
| openshift-lightspeed | lightspeed-agentic-console-rhel9 | — | — |
| openshift-lightspeed | lightspeed-console-plugin-419-rhel9 | — | — |
| openshift-lightspeed | lightspeed-console-plugin-pf5-rhel9 | — | — |
| openshift-lightspeed | lightspeed-console-plugin-rhel9 | — | — |
| openshift-service-mesh | kiali-ossmc-rhel9 | — | — |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv4.06.3MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat6.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
cure53 DOMPurify up to 3.4.5 IN_PLACE sanitization cross site scripting
vuldb·2026-07-15·CVSS 6.3
CVE-2026-49978 [MEDIUM] cure53 DOMPurify up to 3.4.5 IN_PLACE sanitization cross site scripting
A vulnerability labeled as problematic has been found in cure53 DOMPurify up to 3.4.5. This affects an unknown part of the component IN_PLACE sanitization. Such manipulation leads to cross site scripting.
This vulnerability is uniquely identified as CVE-2026-49978. The attack can be launched remotely. No exploit exists.
GHSA
DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content
ghsa·2026-06-15
CVE-2026-49978 [MEDIUM] CWE-79 DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content
DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside .content
If the HTML you give it contains a element, and inside that template there's an element with a shadow DOM attached to it, DOMPurify quietly skips over the shadow contents. Whatever the attacker put in there - an image with an onerror handler, a link with a javascript: URL, even a full script - survives untouched. The moment the application uses that template the way templates are meant to be used (cloning it and inserting the result into the page), the malicious payload comes along and runs as if it had never been sanitized. From there an attacker gets everything XSS normally gets them: session cookies, stored tokens, the ability to act as the user, and the ability to leave persistent payloads behind for the n
Red Hat
dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution
vendor_redhat·2026-07-14·CVSS 6.3
CVE-2026-49978 [MEDIUM] CWE-79 dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution
dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution
A flaw was found in DOMPurify, a tool designed to sanitize HTML, MathML, and SVG to prevent cross-site scripting (XSS) attacks. When performing in-place sanitization, DOMPurify could fail to properly process content within shadow DOM elements attached to a .content. This oversight allows an attacker to embed malicious code, such as JavaScript, which could then execute when the sanitized template is used by an application, potentially leading to unauthorized actions or information disclosure.
Statement: This vulnerability in DOMPurify is rated as Important as it allows for cross-site scripting (XSS) attacks. When DOMPurify performs in-place sanitization, it may fail to properly process shadow DOM content within
No detection rules found.
No public exploits indexed.
2026-07-14
Published