CVE-2026-49978

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.7, DOMPurify IN_PLACE sanitization could skip shadow contents attached to an element inside <template>.content, allowing attacker-controlled markup such as event handlers, JavaScript URLs, or scripts to survive and execute when an application cloned and inserted the sanitized template. This issue is fixed in version 3.4.7.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/cure53/DOMPurify/commit/ca30f070c360df162a3e3848e80e6fd3c9e74bff	Patch
https://github.com/cure53/DOMPurify/releases/tag/3.4.7	Release Notes
https://github.com/cure53/DOMPurify/security/advisories/GHSA-rp9w-3fw7-7cwq	Vendor Advisory Exploit
https://github.com/cure53/DOMPurify/security/advisories/GHSA-rp9w-3fw7-7cwq	Vendor Advisory Exploit

Configurations

Configuration 1 (hide)

cpe:2.3:a:cure53:dompurify:*:*:*:*:*:*:*:*

History

24 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) DOMPurify es un saneador de cross-site scripting exclusivo para DOM para HTML, MathML y SVG. Antes de la versión 3.4.7, el saneamiento IN_PLACE de DOMPurify podría omitir el contenido en la sombra adjunto a un elemento dentro de [template].content, permitiendo que el marcado controlado por el atacante, como controladores de eventos, URLs de JavaScript o scripts, sobreviviera y se ejecutara cuando una aplicación clonaba e insertaba la plantilla saneada. Este problema está solucionado en la versión 3.4.7.

Information

Published : 2026-07-14 21:17

Updated : 2026-10-24 21:10

NVD link : CVE-2026-49978

Mitre link : CVE-2026-49978

CVE.ORG link : CVE-2026-49978

JSON object : View

Products Affected

cure53

dompurify

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2026-49978", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-49978", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-21T14:59:10.987336Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "cure53", "product": "DOMPurify", "versions": [{"status": "affected", "version": "< 3.4.6"}]}]}], "published": "2026-07-14T21:17:02.560", "references": [{"url": "https://github.com/cure53/DOMPurify/commit/ca30f070c360df162a3e3848e80e6fd3c9e74bff", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/cure53/DOMPurify/releases/tag/3.4.7", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-rp9w-3fw7-7cwq", "tags": ["Vendor Advisory", "Exploit"], "source": "security-advisories@github.com"}, {"url": "https://github.com/cure53/DOMPurify/security/advisories/GHSA-rp9w-3fw7-7cwq", "tags": ["Vendor Advisory", "Exploit"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.7, DOMPurify IN_PLACE sanitization could skip shadow contents attached to an element inside <template>.content, allowing attacker-controlled markup such as event handlers, JavaScript URLs, or scripts to survive and execute when an application cloned and inserted the sanitized template. This issue is fixed in version 3.4.7."}, {"lang": "es", "value": "DOMPurify es un saneador de cross-site scripting exclusivo para DOM para HTML, MathML y SVG. Antes de la versi\u00f3n 3.4.7, el saneamiento IN_PLACE de DOMPurify podr\u00eda omitir el contenido en la sombra adjunto a un elemento dentro de [template].content, permitiendo que el marcado controlado por el atacante, como controladores de eventos, URLs de JavaScript o scripts, sobreviviera y se ejecutara cuando una aplicaci\u00f3n clonaba e insertaba la plantilla saneada. Este problema est\u00e1 solucionado en la versi\u00f3n 3.4.7."}], "lastModified": "2026-10-24T21:10:00.130", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cure53:dompurify:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B8B46CA2-8534-449B-8178-06632ED40826", "versionEndExcluding": "3.4.7"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}