Listen to this Post
Intro
CVE-2026-49978 is a cross-site scripting (XSS) vulnerability in DOMPurify, a widely-used DOM‑only HTML sanitizer. The flaw resides in how DOMPurify processes HTML that contains a `` element with an inner node that has its own shadow DOM attached. Instead of walking into the shadow content, DOMPurify skips it entirely, leaving any malicious payload inside the shadow root untouched. To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent may adversely affect certain features and functions. We do not sell your personal data. If you wish to exercise your rights under applicable privacy laws, please visit our Do Not Sell My Personal Information page.
Attackers can craft an input that includes, for example, <template><div>, an `` with an `onerror` handler, or even a full `
Functional
Always active
Preferences
Statistics
Marketing