Cross-site scripting in DOMPurify - CVE-2026-49978

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU132386

Cross-site scripting in DOMPurify - CVE-2026-49978

Published: May 27, 2026


Vulnerability identifier: #VU132386
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2026-49978
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary script in the victim's browser.

The vulnerability exists due to cross-site scripting in template content sanitization when processing HTML containing a template element with an attached shadow root inside template.content. A remote attacker can supply crafted HTML that survives sanitization to execute arbitrary script in the victim's browser.

Exploitation occurs when the application clones the template and inserts the result into the page.


Affected software

DOMPurify
Db2 Developer Extension
InfoSphere Optim Archive Viewer
Ansible Automation Platform
Red Hat Advanced Cluster Security for Kubernetes

How to mitigate CVE-2026-49978

Install security update from vendor's website.

DOMPurify - update to 3.4.7
Db2 Developer Extension - update to 1.2.0
InfoSphere Optim Archive Viewer - update to 11.7.0.15
Ansible Automation Platform - update to 2.2.0
Red Hat Advanced Cluster Security for Kubernetes - update to 4.11.2

External References

Related Security Bulletins