Is CVE-2026-116804 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-116804 being exploited in the wild.

How severe is CVE-2026-116804?

Medium severity, with a CVSS score of 6.1, published 27 October 2026.

Which products and versions are affected?

Cure53 DOMPurify 3.4.4 before 3.4.17.

Is there a fix for CVE-2026-116804?

Yes: fixed in 3.4.17. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-116804 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-116804?

Check whether you run Cure53 DOMPurify at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-116804: DOMPurify SAFE_FOR_TEMPLATES bypass via shadow root content

CVE-2026-116804 · Severity: medium · CVSS 6.1 · Published 2026-10-27

DOMPurify is a JavaScript library that sanitizes HTML and removes potentially malicious code to prevent cross-site scripting attacks. When configured with SAFE_FOR_TEMPLATES mode and certain DOM-output options, an attacker can craft malicious input containing shadow DOM elements that allows template expressions like {{...}} to survive sanitization. If the application then evaluates this content as a template, attackers can execute arbitrary JavaScript code in the victim's browser.

Technologies: Cure53 DOMPurify. Vendors: Cure53.

Quick answers

Is CVE-2026-116804 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-116804 being exploited in the wild.
How severe is CVE-2026-116804?: Medium severity, with a CVSS score of 6.1, published 27 October 2026.
Which products and versions are affected?: Cure53 DOMPurify 3.4.4 before 3.4.17.
Is there a fix for CVE-2026-116804?: Yes: fixed in 3.4.17. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-116804 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-116804?: Check whether you run Cure53 DOMPurify at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 3.4.17

Technical details

The vulnerability is a SAFE_FOR_TEMPLATES bypass affecting DOMPurify's post-walk sanitization pass (_scrubTemplateExpressions), which fails to recurse into attached shadow roots when normalizing text nodes. An attacker can split template expressions across text nodes separated by disallowed elements; after those elements are removed during sanitization, the text fragments merge into a complete, executable expression. This requires the application to use RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE modes, pass a DOM node with an already-attached shadow root, and subsequently evaluate the shadow root content as a template.

Affected products

Cure53 DOMPurify 3.4.4 before 3.4.17

Timeline

2026-10-12: disclosed
2026-10-27: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.