{"affected":[{"defaultStatus":"unaffected","ecosystem":"npm","packageName":"dompurify","product":"DOMPurify","source":"CNA: VulnCheck","vendor":"cure53","versions":[{"lessThan":"3.4.17","status":"affected","version":"3.4.4","versionType":"semver"},{"status":"unaffected","version":"3.4.17","versionType":"semver"}]},{"defaultStatus":"unaffected","ecosystem":"npm","packageName":"dompurify","product":"dompurify","source":"OSV GHSA-cg2g-xh64-v4q7","vendor":"","versions":[{"events":[{"introduced":"3.4.4"},{"fixed":"3.4.17"}],"lessThan":"3.4.17","status":"affected","version":"3.4.4","versionType":"semver"}]}],"cveId":"CVE-2026-116804","cwes":["CWE-79"],"description":"DOMPurify from 3.4.4 before 3.4.17 contains a SAFE_FOR_TEMPLATES bypass that lets attackers preserve template expressions in attached shadow roots when using RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE modes. Attackers can split expressions across text nodes separated by disallowed elements, which merge after removal and are evaluated by downstream template engines for cross-site scripting.","epss":{"date":"2026-11-02","percentile":0.07402,"score":0.00178},"exploits":[{"kind":"exploit","source":"ADP: CISA-ADP","url":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-cg2g-xh64-v4q7"}],"kev":null,"metrics":[{"score":5.1,"severity":"medium","source":"CNA: VulnCheck","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","version":"4.0"},{"score":6.1,"severity":"medium","source":"CNA: VulnCheck","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"}],"modifiedAt":1793644897395,"publishedAt":1793055935850,"references":[{"source":"CNA: VulnCheck","tags":["vendor-advisory"],"url":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-cg2g-xh64-v4q7"},{"source":"CNA: VulnCheck","tags":["third-party-advisory"],"url":"https://www.vulncheck.com/advisories/dompurify-from-3.4.4-before-3.4.17-safe-for-templates-bypass-via-shadow-root-content"},{"source":"ADP: CISA-ADP","tags":["exploit"],"url":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-cg2g-xh64-v4q7"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-cg2g-xh64-v4q7"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-cg2g-xh64-v4q7"}],"remediation":[{"kind":"fix","source":"OSV GHSA-cg2g-xh64-v4q7","text":"dompurify (npm): OSV reports a fixed version 3.4.17. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-cg2g-xh64-v4q7"}],"revision":"19be823e005fff83f7135295927ad825480c6c0e63952cc3ed22ede46b60cda7","sources":[{"modifiedAt":1793644897395,"name":"CNA: VulnCheck","retrievedAt":1793646535200,"url":"https://www.cve.org/CVERecord?id=CVE-2026-116804"},{"modifiedAt":1793098568031,"name":"OSV / GitHub Security Advisories","retrievedAt":1793646535728,"url":"https://osv.dev/vulnerability/GHSA-cg2g-xh64-v4q7"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793646542054,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-116804"}],"ssvc":{"assessedAt":1793644814696,"automatable":"no","exploitation":"poc","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"DOMPurify from 3.4.4 before 3.4.17 SAFE_FOR_TEMPLATES Bypass via Shadow Root Content","updatedAt":1793646542054}