PT-2026-49559 · Npm · Dompurify

Published 2026-06-15 · Updated 2026-06-15 · CVE-2026-49978

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions DOMPurify (affected versions not specified)

Description An issue exists where the sanitizer skips the contents of a shadow DOM attached to an element inside a <template> element. This allows malicious payloads, such as images with onerror handlers, links with javascript: URLs, or script tags, to remain untouched during the sanitization process. When the application clones the template and inserts it into the page, the payload executes, leading to Cross-Site Scripting (XSS), which is a technique used to inject malicious scripts into web pages. This can result in the theft of session cookies and stored tokens, allowing an attacker to act as the user or leave persistent payloads for other visitors.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-49978

GHSA-RP9W-3FW7-7CWQ

Affected Products

Dompurify

References · 4

• https://osv.dev/vulnerability/GHSA-rp9w-3fw7-7cwq · Vendor Advisory
• https://github.com/cure53/DOMPurify · Note
• https://github.com/cure53/DOMPurify/security/advisories/GHSA-rp9w-3fw7-7cwq · Note
• https://twitter.com/dailycve/status/2066631781546143815 · Twitter Post