{"id":"ghsa-ghsa-cg2g-xh64-v4q7","seq":309575,"kind":"advisory","title":"DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes","url":"https://github.com/advisories/GHSA-cg2g-xh64-v4q7","permalink":"https://vulnpulse.app/items/ghsa-ghsa-cg2g-xh64-v4q7","summary":"影響: npm:dompurify >= 3.4.4, <= 3.4.16 → 3.4.17\nWhen DOMPurify is configured with SAFE_FOR_TEMPLATES: true together with a DOM-returning mode (RETURN_DOM: true, RETURN_DOM_FRAGMENT: true, or IN_PLACE: true), template expressions such as {{...}}, ${...}, and survive sanitization inside the text content of an attached shadow root. The post-walk safety net _scrubTemplateExpressions (src/purify.ts:1717) was extended to recurse into .content, but it never recurses into attached shadow roots. An attacker who can supply a DOM node carrying a shadow…","severity":"critical","techs":["nodejs"],"cves":[],"tags":["GHSA-cg2g-xh64-v4q7","dompurify"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-22T16:25:31.000Z","fetched_at":"2026-10-22T20:09:55.169Z"}