CVE-2026-79320: Stencil Core DOM-Based XSS Vulnerability

CVE-2026-79320 Overview

CVE-2026-79320 is a DOM-based cross-site scripting (XSS) vulnerability in Stencil core version 4.43.5, a compiler used to build web components and design systems. The flaw affects downstream applications that enable the experimental slot fixes option together with scoped components. Assigning a string to the textContent property of a scoped component's host element causes the runtime to parse the value as HTML rather than insert it as plain text. Attacker-controlled data written to these host elements can be interpreted as markup, allowing script execution in the application's origin [CWE-79].

Critical Impact
Attackers who influence data written to textContent on a scoped Stencil component host can execute arbitrary JavaScript in the victim's browser context, enabling session theft, UI manipulation, and cross-origin abuse against the hosting application.

Affected Products

Stencil core 4.43.5
Downstream applications enabling the experimental slot fixes option
Applications using scoped Stencil components with dynamic textContent assignments

Discovery Timeline

2026-09-21 - CVE-2026-79320 published to the National Vulnerability Database (NVD)
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-79320

Vulnerability Analysis

Stencil generates web components that ship a client-side runtime responsible for slot management, DOM patching, and scoped styling. In version 4.43.5, the experimental slot fixes code path modifies how the runtime intercepts writes to host element properties. When scoped components are in use, an assignment to textContent is redirected through a helper that treats the incoming string as HTML markup instead of a text node.

As a result, developer code that appears safe, such as setting hostEl.textContent = userInput, no longer produces the browser's standard behavior of inserting text verbatim. Instead, tags in the input are parsed, DOM nodes are constructed, and inline event handlers or <script> payloads inside the assigned string can execute. The vulnerability requires user interaction, since a victim must load a page that reflects attacker-controlled data into an affected component.

Root Cause

The root cause is incorrect neutralization of input during web page generation [CWE-79] inside Stencil's scoped-component runtime. The experimental slot fixes option changes the property descriptor for textContent on host elements so that assignments delegate to an HTML-parsing path rather than to the native Node.textContent setter. This breaks the security assumption that textContent is a safe sink and converts it into an HTML sink equivalent to innerHTML.

Attack Vector

Exploitation requires an application built with Stencil 4.43.5 that opts into the experimental slot fixes flag and renders scoped components whose host elements receive untrusted data through textContent. An attacker delivers a crafted string, such as through a URL parameter, stored record, or postMessage payload, that the application writes to the vulnerable property. When the victim opens the page, the Stencil runtime parses the string as markup and executes the embedded script in the application's origin.

No verified public proof-of-concept code is available. Refer to the GitHub CVE-2026-79320 Details advisory and the Stencil.js Core Repository for technical context.

Detection Methods for CVE-2026-79320

Indicators of Compromise

Unexpected <script>, <img onerror=...>, or <iframe> nodes appearing inside scoped Stencil component host elements at runtime.
Content Security Policy (CSP) violation reports referencing inline script executions originating from custom-element hosts.
Outbound requests from browsers to unknown domains immediately after rendering pages that display user-supplied text in web components.

Detection Strategies

Audit application source for the experimental slot fixes configuration flag combined with scoped: true component metadata.
Grep repositories for direct assignments to textContent on Stencil component references and flag any that receive untrusted data.
Deploy a strict CSP with script-src restrictions and monitor report-uri endpoints for violations tied to affected pages.

Monitoring Recommendations

Instrument browser telemetry or Real User Monitoring to record CSP violations and DOM mutation anomalies inside custom elements.
Correlate web application firewall (WAF) logs for reflected HTML payloads targeting endpoints that feed component textContent.
Track dependency inventories for Stencil core 4.43.5 across build pipelines and CI artifacts.

How to Mitigate CVE-2026-79320

Immediate Actions Required

Disable the experimental slot fixes option in Stencil configuration until a fixed release is adopted.
Replace textContent assignments on scoped component hosts with explicit text-node creation using document.createTextNode() and appendChild().
Sanitize or HTML-encode any attacker-controlled data before it reaches Stencil component properties.
Enforce a strict CSP that disallows inline scripts and restricts script sources to trusted origins.

Patch Information

At the time of publication, no fixed version is listed in the NVD entry for CVE-2026-79320. Monitor the Stencil.js Core Repository for a release that addresses the scoped-component textContent handling and upgrade once available. Applications should pin Stencil to a non-affected version and rebuild all downstream component libraries.

Workarounds

Turn off the experimental slot fixes flag in stencil.config.ts and rebuild affected component bundles.
Refactor components to render untrusted values through slotted child text nodes rather than host textContent.
Wrap user input with a vetted sanitizer such as DOMPurify before passing it to any DOM sink in scoped components.

bash

# Configuration example: disable experimental slot fixes in stencil.config.ts
export const config: Config = {
  namespace: 'app',
  extras: {
    experimentalSlotFixes: false
  }
};