DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.7, DOMPurify IN_PLACE sanitization could skip shadow contents attached to an element inside <template>.content, allowing attacker-controlled markup such as event handlers, JavaScript URLs, or scripts to survive and execute when an application cloned and inserted the sanitized template. This issue is fixed in version 3.4.7.
References
| Link | Resource |
|---|---|
| https://github.com/cure53/DOMPurify/commit/ca30f070c360df162a3e3848e80e6fd3c9e74bff | Patch |
| https://github.com/cure53/DOMPurify/releases/tag/3.4.7 | Release Notes |
| https://github.com/cure53/DOMPurify/security/advisories/GHSA-rp9w-3fw7-7cwq | Vendor Advisory Exploit |
| https://github.com/cure53/DOMPurify/security/advisories/GHSA-rp9w-3fw7-7cwq | Vendor Advisory Exploit |
Configurations
History
21 Jul 2026, 19:49
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/cure53/DOMPurify/commit/ca30f070c360df162a3e3848e80e6fd3c9e74bff - Patch | |
| References | () https://github.com/cure53/DOMPurify/releases/tag/3.4.7 - Release Notes | |
| References | () https://github.com/cure53/DOMPurify/security/advisories/GHSA-rp9w-3fw7-7cwq - Vendor Advisory, Exploit | |
| First Time |
Cure53 dompurify
Cure53 |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.1 |
| CPE | cpe:2.3:a:cure53:dompurify:*:*:*:*:*:*:*:* |
21 Jul 2026, 16:17
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/cure53/DOMPurify/security/advisories/GHSA-rp9w-3fw7-7cwq - |
14 Jul 2026, 21:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-07-14 21:17
Updated : 2026-07-21 19:49
NVD link : CVE-2026-49978
Mitre link : CVE-2026-49978
CVE.ORG link : CVE-2026-49978
JSON object : View
Products Affected
cure53
- dompurify
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')