CVE-2026-49978: 
JavaScript vulnerability analysis and mitigation

CVE-2026-49978 is a Cross-Site Scripting (XSS) sanitization bypass vulnerability in DOMPurify, a widely used DOM-only XSS sanitizer for HTML, MathML, and SVG. The flaw affects DOMPurify versions prior to 3.4.7 (specifically <= 3.4.6) and was discovered by researcher GameZoneHacker. It was first published to the GitHub Advisory Database on May 27, 2026, and assigned CVE ID on June 15, 2026. The vulnerability carries a CVSS v3.1 base score of 6.1 (Medium) and a CVSS v4.0 base score of 6.3 (Medium) (Github Advisory, Red Hat Bugzilla).

The root cause is improper neutralization of user-controlled input during web page generation (CWE-79). When DOMPurify's IN_PLACE sanitization mode processes HTML containing a <template> element, it fails to traverse and sanitize shadow DOM contents attached to elements inside <template>.content. As a result, attacker-controlled markup — including onerror event handlers, javascript: URLs, or full <script> tags — embedded within those shadow roots survives the sanitization pass entirely untouched. The payload executes when the application subsequently clones the sanitized template and inserts it into the live DOM, which is the standard intended usage pattern for <template> elements. A proof-of-concept (poc.html) was published alongside the security advisory (Github Advisory, DOMPurify Release).

Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript in the context of a victim user's browser session. This grants access to session cookies, authentication tokens, and any sensitive data accessible to the page, and enables the attacker to perform actions on behalf of the user. Persistent payloads can also be left behind to affect subsequent visitors, and the scope of impact extends to any downstream system or data accessible through the compromised session (Github Advisory, Red Hat Bugzilla).

1. Identify a target application: Find a web application that uses DOMPurify <= 3.4.6 with IN_PLACE sanitization mode and accepts user-supplied HTML that is subsequently rendered via <template> cloning.
2. Craft malicious HTML: Construct an HTML payload containing a <template> element with a child element that has a shadow DOM attached, embedding a malicious payload inside the shadow root — for example, <img> with an onerror handler, a <a href="javascript:..."> link, or a <script> tag.
3. Submit the payload: Inject the crafted HTML into the application through any user-controlled input field that is processed by DOMPurify's IN_PLACE sanitizer (e.g., a rich text editor, comment field, or profile bio).
4. Bypass sanitization: DOMPurify's IN_PLACE mode skips traversal of shadow root contents inside <template>.content, leaving the malicious markup intact after sanitization.
5. Trigger execution: When the application clones the sanitized template (e.g., via template.content.cloneNode(true)) and inserts it into the live DOM, the malicious payload executes in the victim's browser context, enabling session hijacking, credential theft, or persistent XSS (Github Advisory).

• Network: Unexpected outbound HTTP requests from a user's browser to attacker-controlled domains (e.g., for cookie exfiltration via document.cookie sent to an external endpoint) following interaction with template-rendered content.
• Logs: Web server or application logs showing submission of HTML payloads containing <template> elements with shadow DOM markup (e.g., attachShadow, shadowRoot) in user input fields.
• Browser/Client-Side: Unexpected JavaScript execution originating from cloned template content; browser developer tools showing script execution from within shadow DOM nodes; CSP violation reports triggered by inline event handlers or javascript: URLs.
• File System / Stored Content: Persisted user-generated content in databases containing <template> tags with nested shadow root markup or encoded event handler attributes (onerror, onload, javascript:).

The primary remediation is to upgrade DOMPurify to version 3.4.7 or later, which hardens the handling of shadow roots when using IN_PLACE mode (DOMPurify Release, DOMPurify Commit). As an interim workaround, avoid using IN_PLACE sanitization mode with HTML that may contain <template> elements until patching is complete. Additionally, review all application code that clones and inserts sanitized templates to ensure they are using the patched version, and consider implementing a Content Security Policy (CSP) to limit the impact of any XSS execution (Github Advisory, Red Hat Bugzilla).

Red Hat tracked the vulnerability as high severity in their Bugzilla system and assigned it to their Product Security DevOps Team for triage across affected products (Red Hat Bugzilla). The DOMPurify maintainers (Cure53) credited researcher GameZoneHacker for the discovery and released the fix promptly in version 3.4.7 (DOMPurify Release). The vulnerability was picked up by standard security tracking feeds including OSV, Vulners, and Tenable shortly after disclosure, indicating routine community awareness without significant controversy or widespread alarm.