DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes
影響: npm:dompurify >= 3.4.4, <= 3.4.16 → 3.4.17
When DOMPurify is configured with SAFE_FOR_TEMPLATES: true together with a DOM-returning mode (RETURN_DOM: true, RETURN_DOM_FRAGMENT: true, or IN_PLACE: true), template expressions such as {{...}}, ${...}, and survive sanitization inside the text content of an attached shadow root. The post-walk safety net _scrubTemplateExpressions (src/purify.ts:1717) was extended to recurse into .content, but it never recurses into attached shadow roots. An attacker who can supply a DOM node carrying a shadow…
Read on GitHub Advisory Database
| Source | GitHub Advisory Database |
|---|---|
| Fetched | 10/23/2026, 05:09 AM |
| Data | Markdown JSON |
On 10/23/2026, 01:25 AM, GitHub Advisory Database published "DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes" (type: Advisory). Severity is "Critical" (critical). Related technologies: JavaScript / Node.js.