CVE-2026-49978: DOMPurify XSS Vulnerability

CVE-2026-49978 Overview

CVE-2026-49978 is a cross-site scripting (XSS) sanitization bypass in DOMPurify, a widely used DOM-only sanitizer for HTML, MathML, and SVG. Versions prior to 3.4.7 fail to sanitize shadow contents attached to elements inside <template>.content when using IN_PLACE sanitization mode. Attacker-controlled markup including event handlers, javascript: URLs, or <script> payloads can survive sanitization. The malicious content executes when an application clones and inserts the sanitized template into the live DOM. The issue is categorized under CWE-79 and is fixed in DOMPurify 3.4.7.

Critical Impact
Successful exploitation delivers stored or reflected XSS in applications that rely on DOMPurify with IN_PLACE mode and template cloning, enabling session hijacking, credential theft, and arbitrary script execution in the victim's browser context.

Affected Products

DOMPurify versions prior to 3.4.7
Web applications using DOMPurify with IN_PLACE sanitization on <template> elements
Frameworks and libraries that bundle vulnerable DOMPurify releases

Discovery Timeline

2026-07-14 - CVE-2026-49978 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-49978

Vulnerability Analysis

DOMPurify offers an IN_PLACE sanitization mode that mutates a DOM subtree directly rather than returning a serialized string. When the traversal walks into an HTMLTemplateElement, its parsed markup lives in an inert contentDocumentFragment attached as a separate document. The sanitizer's node iterator did not descend into shadow content hosted on elements inside that fragment. Nodes carrying event handler attributes, javascript: URLs, or <script> tags therefore remained untouched. When downstream code invoked document.importNode(template.content, true) or cloneNode(true) and appended the fragment to the live document, the browser parsed and executed the attacker-controlled payload.

Root Cause

The defect stems from incomplete traversal logic in the IN_PLACE code path. The iterator treated shadow content on elements nested inside template.content as out of scope, skipping sanitization of nodes the browser would later render. This gap violates the sanitizer's core invariant that every node reachable at insertion time has been inspected.

Attack Vector

Exploitation requires an application that accepts untrusted HTML, invokes DOMPurify with the IN_PLACE option on a <template> element, then clones and inserts the sanitized fragment. The attacker submits crafted markup that places dangerous nodes within the shadow content boundary. User interaction with the rendered page triggers the surviving payload in the origin of the vulnerable application.

typescript

// Security patch in dist/purify.cjs.d.ts - release: 3.4.7 (#1414)
-/*! @license DOMPurify 3.4.6 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.4.6/LICENSE */
+/*! @license DOMPurify 3.4.7 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.4.7/LICENSE */

import { TrustedTypePolicy, TrustedTypesWindow, TrustedHTML } from 'trusted-types/lib/index.js';

Source: GitHub Commit ca30f070. The 3.4.7 release extends the sanitization walker to reach shadow contents inside template.content.

Detection Methods for CVE-2026-49978

Indicators of Compromise

Outbound requests from browser sessions to unexpected domains shortly after users render user-generated HTML.
Server logs showing submitted content containing <template> tags wrapping elements with on* event handlers or javascript: URLs.
Content Security Policy (CSP) violation reports referencing inline scripts injected through template cloning flows.

Detection Strategies

Perform a software composition analysis scan across build manifests (package.json, package-lock.json, yarn.lock) for DOMPurify releases below 3.4.7.
Instrument client code to log invocations of DOMPurify with the IN_PLACE option on template elements for security review.
Review web application firewall (WAF) telemetry for submissions combining <template> with event handler attributes or script sources.

Monitoring Recommendations

Enable CSP report-uri or report-to directives to capture blocked script executions originating from sanitized fragments.
Alert on anomalous DOM mutations that introduce script nodes into pages rendering user content.
Correlate authentication anomalies such as session token reuse with pages that process untrusted HTML.

How to Mitigate CVE-2026-49978

Immediate Actions Required

Upgrade DOMPurify to version 3.4.7 or later across all application dependencies and vendored copies.
Audit application code for uses of the IN_PLACE option combined with <template> elements and clone operations.
Rebuild and redeploy frontend bundles to ensure the patched library ships to end users.

Patch Information

The fix ships in DOMPurify 3.4.7. See the GitHub Release 3.4.7 and the GitHub Security Advisory GHSA-rp9w-3fw7-7cwq for the full remediation details and the corresponding commit ca30f070.

Workarounds

Avoid the IN_PLACE mode until the upgrade lands and instead use the default DOMPurify.sanitize(input) which returns a sanitized string.
Reject or strip <template> elements from untrusted input at the server or intermediate layer.
Enforce a strict Content Security Policy that blocks inline scripts and restricts script sources to trusted origins.

bash

# Upgrade DOMPurify via npm
npm install dompurify@3.4.7

# Or via yarn
yarn add dompurify@3.4.7

# Verify the installed version
npm ls dompurify