UpHeron
All vulnerabilities

npm

GHSA-cg2g-xh64-v4q7

DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes

Severity
Critical
Published
22 Oct 2026
Last changed
22 Oct 2026
Added to UpHeron
23 Oct 2026
Fixed in
3.4.17
Sources
OSV.dev and GitHub

Affected software

SoftwareAffected versions
dompurifynpm · osv:npm:dompurify
  • From 3.4.4 before 3.4.17

References