Read the docs
TI-2026-36811 Aliases CVE-2026-49978GHSA-rp9w-3fw7-7cwq

DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content

Priority MEDIUM 61CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · None · None
Fix status
Partial Red Hat: 28 fixed, 10 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.

Summary

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.7, DOMPurify IN_PLACE sanitization could skip shadow contents attached to an element inside <template>.content, allowing attacker-controlled markup such as event handlers, JavaScript URLs, or scripts to survive and execute when an application cloned and inserted the sanitized template. This issue is fixed in version 3.4.7.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00404 34th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial DOMPurify (cure53): 3.4.6dompurify (npm): 3.4.7Red Hat: 31 advisoriesRed Hat: 28 fixed, 10 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
cure53DOMPurifybefore 3.4.63.4.6Patch availableCNA
—dompurify (npm)before 3.4.73.4.7Patch availableGHSA-rp9w-3fw7-7cwq
  • DOMPurify Vendorcure53 Affected before 3.4.6 Fixed in 3.4.6 Patch available CNA
  • dompurify (npm) Vendor— Affected before 3.4.7 Fixed in 3.4.7 Patch available GHSA-rp9w-3fw7-7cwq

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:cure53:dompurify:*:*:*:*:*:*:*:*before 3.4.7Vulnerablecure53
  • cpe:2.3:a:cure53:dompurify:*:*:*:*:*:*:*:* Versions before 3.4.7 Vulnerable ·cure53

Remediation

  • Fix · CNA DOMPurify (cure53) Fixed in 3.4.6
  • Fix · GHSA-rp9w-3fw7-7cwq dompurify (npm) Fixed in 3.4.7 Advisory →

Red Hat 31 advisories

  • RHSA-2026:95360 Released 2026-11-04 · Red Hat rating Important
    Red Hat build of Cryostat security update
    • Cryostat 4 on RHEL 9 cryostat/cryostat-grafana-dashboard-rhel9, cryostat/cryostat-openshift-console-plugin-rhel9, cryostat/cryostat-storage-rhel9
  • RHSA-2026:84734 Released 2026-10-19 · Red Hat rating Critical
    RHOAI 3.4.5 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47
  • RHSA-2026:69296 Released 2026-09-21 · Red Hat rating Important
    Red Hat Data Grid 8.6.3 security update
    • Red Hat Data Grid 8.6.3
Show 28 more Red Hat advisories
  • RHSA-2026:68333 Released 2026-09-16 · Red Hat rating Important
    Red Hat build of Cryostat security update
    • Cryostat 4 on RHEL 9 cryostat/cryostat-agent-init-rhel9, cryostat/cryostat-grafana-dashboard-rhel9, cryostat/cryostat-openshift-console-plugin-rhel9 +5
  • RHSA-2026:66545 Released 2026-09-10 · Red Hat rating Important
    Red Hat AMQ Broker 7.13.6 release and security update
    • Red Hat AMQ Broker 7.13.6
  • RHSA-2026:66488 Released 2026-09-10 · Red Hat rating Important
    Red Hat AMQ Broker 7.14.1 release and security update
    • Red Hat AMQ Broker 7.14.1
  • RHSA-2026:65126 Released 2026-09-08 · Red Hat rating Important
    RHOAI 2.25.11 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
  • RHSA-2026:62260 Released 2026-09-01 · Red Hat rating Important
    Red Hat OpenShift Dev Spaces 3.30.0 Release.
    • Red Hat OpenShift Dev Spaces 3.30 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/configbump-rhel9, registry.redhat.io/devspaces/dashboard-rhel9 +7
  • RHSA-2026:60520 Released 2026-08-27 · Red Hat rating Critical
    RHOAI 3.4.4 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9, registry.redhat.io/rhoai/odh-built-in-detector-rhel9 +47
  • RHSA-2026:59360 Released 2026-08-25 · Red Hat rating Important
    Apicurio Registry (container images) release and security update [ 3.3.1 GA ]
    • Red Hat build of Apicurio Registry 3.3.1
  • RHSA-2026:57590 Released 2026-08-20 · Red Hat rating Important
    rh-podman-desktop security, bug fix, and enhancement update
    • Red Hat Enterprise Linux Extensions Channel (v. 10) rh-podman-desktop-1.1.2-1.el10_2
  • RHSA-2026:54435 Released 2026-08-12 · Red Hat rating Important
    Streams for Apache Kafka 3.2.1 release and security update
    • Streams for Apache Kafka 3.2.1
  • RHSA-2026:51007 Released 2026-08-12 · Red Hat rating Important
    OpenShift Container Platform 4.19.42 bug fix and security update
    • Red Hat OpenShift Container Platform 4.19 registry.redhat.io/openshift4/ose-monitoring-plugin-rhel9, registry.redhat.io/openshift4/ose-oauth-proxy-rhel9, registry.redhat.io/openshift4/ose-ovn-kubernetes-rhel9
  • RHSA-2026:53840 Released 2026-08-11 · Red Hat rating Important
    OpenShift Virtualization v4.15 Images
    • Red Hat Container Native Virtualization 4.15 registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9
  • RHSA-2026:53735 Released 2026-08-11 · Red Hat rating Important
    OpenShift Virtualization v4.13 Images
    • Red Hat Container Native Virtualization 4.13 registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9
  • RHSA-2026:52768 Released 2026-08-10 · Red Hat rating Important
    Red Hat Developer Hub 1.9.8 release.
    • Red Hat Developer Hub 1.9 registry.redhat.io/rhdh/rhdh-hub-rhel9
  • RHSA-2026:48670 Released 2026-08-04 · Red Hat rating Critical
    OpenShift Container Platform 4.21.27 bug fix and security update
    • Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/ose-hypershift-rhel9, registry.redhat.io/openshift4/ose-monitoring-plugin-rhel9
  • RHSA-2026:48676 Released 2026-08-04 · Red Hat rating Critical
    OpenShift Container Platform 4.20.32 bug fix and security update
    • Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/ose-azure-workload-identity-webhook-rhel9, registry.redhat.io/openshift4/ose-hypershift-rhel9, registry.redhat.io/openshift4/ose-monitoring-plugin-rhel9
  • RHSA-2026:48693 Released 2026-08-04 · Red Hat rating Critical
    OpenShift Container Platform 4.22.8 bug fix and security update
    • Red Hat OpenShift Container Platform 4.22 registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9, registry.redhat.io/openshift4/ose-hypershift-rhel9, registry.redhat.io/openshift4/ose-installer-artifacts-rhel9 +2
  • RHSA-2026:49735 Released 2026-08-03 · Red Hat rating Important
    Kiali 2.27.2 for Red Hat OpenShift Service Mesh 3.4
    • Red Hat OpenShift Service Mesh 3.4 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
  • RHSA-2026:49680 Released 2026-08-03 · Red Hat rating Important
    Kiali 2.22.8 for Red Hat OpenShift Service Mesh 3.3
    • Red Hat OpenShift Service Mesh 3.3 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
  • RHSA-2026:49642 Released 2026-08-03 · Red Hat rating Important
    Red Hat Developer Hub 1.10.3 release.
    • Red Hat Developer Hub 1.10 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
  • RHSA-2026:48913 Released 2026-07-30 · Red Hat rating Important
    RHACS 4.10.6 security and bug fix update
    • Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator
  • RHSA-2026:48891 Released 2026-07-30 · Red Hat rating Important
    RHACS 4.11.2 security and bug fix update
    • Red Hat Advanced Cluster Security for Kubernetes 4.11 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel9
  • RHSA-2026:48872 Released 2026-07-30 · Red Hat rating Important
    RHACS 4.9.10 security and bug fix update
    • Red Hat Advanced Cluster Security 4.9 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator, registry.redhat.io/advanced-cluster-security/rhacs-scanner-v4-rhel8
  • RHSA-2026:48126 Released 2026-07-29 · Red Hat rating Important
    Red Hat Developer Hub 1.10.3 Plugin Catalog GA plugins release.
    • Red Hat Developer Hub 1.10 registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed, registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend, registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator +4
  • RHSA-2026:46623 Released 2026-07-27 · Red Hat rating Important
    OpenShift Virtualization v4.12 Images
    • Red Hat Container Native Virtualization 4.12 registry.redhat.io/container-native-virtualization/kubevirt-console-plugin
  • RHSA-2026:46558 Released 2026-07-27 · Red Hat rating Important
    OpenShift Virtualization v4.17 Images
    • Red Hat Container Native Virtualization 4.17 registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9
  • RHSA-2026:46539 Released 2026-07-27 · Red Hat rating Important
    OpenShift Virtualization v4.14 Images
    • Red Hat Container Native Virtualization 4.14 registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9
  • RHSA-2026:43625 Released 2026-07-22 · Red Hat rating Important
    OpenShift Virtualization v4.22 Images
    • Red Hat Container Native Virtualization 4.22 registry.redhat.io/container-native-virtualization/kubevirt-console-plugin-rhel9
  • RHSA-2026:42815 Released 2026-07-21 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.2 security update
    • Red Hat Ansible Automation Platform 2.2 registry.redhat.io/ansible-automation-platform/automation-portal

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Cryostat 4AffectedNo fix yet
Migration Toolkit for VirtualizationAffectedNo fix yet
Node HealthCheck OperatorAffectedNo fix yet
Red Hat Ansible Automation Platform 2AffectedNo fix yet
Red Hat Build of Podman DesktopAffectedNo fix yet
Red Hat Ceph Storage 9AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 5AffectedNo fix yet
Red Hat OpenShift GitOpsAffectedNo fix yet
Red Hat Openshift Data Foundation 4AffectedNo fix yet
Red Hat build of Apache Camel - HawtIO 4AffectedNo fix yet
Cryostat 4 on RHEL 9Fixed RHSA-2026:68333, RHSA-2026:95360
Red Hat AMQ Broker 7.13.6Fixed RHSA-2026:66545
Red Hat AMQ Broker 7.14.1Fixed RHSA-2026:66488
Red Hat Advanced Cluster Security 4.9Fixed RHSA-2026:48872
Red Hat Advanced Cluster Security for Kubernetes 4.11Fixed RHSA-2026:48891
Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10Fixed RHSA-2026:48913
Red Hat Ansible Automation Platform 2.2Fixed RHSA-2026:42815
Red Hat Container Native Virtualization 4.12Fixed RHSA-2026:46623
Red Hat Container Native Virtualization 4.13Fixed RHSA-2026:53735
Red Hat Container Native Virtualization 4.14Fixed RHSA-2026:46539
Red Hat Container Native Virtualization 4.15Fixed RHSA-2026:53840
Red Hat Container Native Virtualization 4.17Fixed RHSA-2026:46558
Red Hat Container Native Virtualization 4.22Fixed RHSA-2026:43625
Red Hat Data Grid 8.6.3Fixed RHSA-2026:69296
Red Hat Developer Hub 1.10Fixed RHSA-2026:48126, RHSA-2026:49642
Red Hat Developer Hub 1.9Fixed RHSA-2026:52768
Red Hat Enterprise Linux Extensions Channel (v. 10)Fixed RHSA-2026:57590
Red Hat OpenShift AI 2.25Fixed RHSA-2026:65126
Red Hat OpenShift AI 3.4Fixed RHSA-2026:60520, RHSA-2026:84734
Red Hat OpenShift Container Platform 4.19Fixed RHSA-2026:51007
Red Hat OpenShift Container Platform 4.20Fixed RHSA-2026:48676
Red Hat OpenShift Container Platform 4.21Fixed RHSA-2026:48670
Red Hat OpenShift Container Platform 4.22Fixed RHSA-2026:48693
Red Hat OpenShift Dev Spaces 3.30Fixed RHSA-2026:62260
Red Hat OpenShift Service Mesh 3.3Fixed RHSA-2026:49680
Red Hat OpenShift Service Mesh 3.4Fixed RHSA-2026:49735
Red Hat build of Apicurio Registry 3.3.1Fixed RHSA-2026:59360
Streams for Apache Kafka 3.2.1Fixed RHSA-2026:54435
Not affected: 30 products
  • Cryostat 4
  • Cryostat 4 on RHEL 9
  • Multicluster Engine for Kubernetes
  • OpenShift Lightspeed
  • Red Hat 3scale API Management Platform 2
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Advanced Cluster Security 4.9
  • Red Hat Advanced Cluster Security for Kubernetes 4.11
  • Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10
  • Red Hat Ansible Automation Platform 2
  • Red Hat Developer Hub 1.10
  • Red Hat Developer Hub 1.9
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Hardened Images
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 2.25
  • Red Hat OpenShift AI 3.4
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 4.19
  • Red Hat OpenShift Container Platform 4.20
  • Red Hat OpenShift Container Platform 4.21
  • Red Hat OpenShift Container Platform 4.22
  • Red Hat OpenShift Container Platform 5
  • Red Hat OpenShift Dev Spaces 3.30
  • Red Hat OpenShift Service Mesh 3.4
  • Red Hat Openshift Data Foundation 4
  • Red Hat build of Apache Camel for Spring Boot 4
  • streams for Apache Kafka 2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-49978
  2. 2026-10-03 Alias added: GHSA-rp9w-3fw7-7cwq
  3. 2026-10-09 Fix available: RHSA-2026:59360 · Red Hat
  4. 2026-10-09 Fix available: Red Hat build of Apicurio Registry 3.3.1 · Red Hat
  5. 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
  6. 2026-10-20 Affected versions changed · Red Hat
  7. 2026-10-23 Fix available: Red Hat Advanced Cluster Security for Kubernetes for IBM Z and LinuxONE 4.11 · Red Hat
  8. 2026-10-30 Affected versions changed · Red Hat
  9. 2026-10-31 Fix available: Red Hat Advanced Cluster Security for Kubernetes 4.11 · Red Hat
  10. 2026-11-03 Affected versions changed · Red Hat
  11. 2026-11-05 Fix available: Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 · Red Hat
  12. 2026-11-06 Fix available: RHSA-2026:95360 · Red Hat

References

Exploit 1

Patch 1

Other 2

  • TI-2026-34986 DOMPurify XSS via `selectedcontent` re-clone CVSS 3.1HIGH 8.2
  • TI-2026-36614 DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM CVSS 3.1MEDIUM 6.1
  • TI-2026-36613 DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks CVSS 3.1MEDIUM 6.1
  • TI-2026-29849 DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix) CVSS 4.0MEDIUM 6.0
  • TI-2025-19705 Cross-site scripting in cure53 DOMPurify CVSS 3.1MEDIUM 6.1
  • TI-2026-46952 DOMPurify before 3.3.2 Mutation XSS via Re-Contextualization CVSS 4.0MEDIUM 5.3
See all 25 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences