DOMPurify GHSA-cg2g-xh64-v4q7: SAFE_FOR_TEMPLATES bypass via shadow root content with RETURN_DOM / RETURN_DOM_FRAGMENT / IN_PLACE (template expressions survive, client-side template injection). Which versions and how do I fix?

What it is: A critical advisory published 2026-10-22 for DOMPurify, the widely used HTML sanitizer. With SAFE_FOR_TEMPLATES enabled, DOMPurify is supposed to strip template expressions such as {{...}}, ${...} and <%...%> so a later template engine (Angular-style, Vue, lodash/EJS-style templates) won't evaluate them. When DOMPurify returns DOM nodes instead of a string (RETURN_DOM, RETURN_DOM_FRAGMENT or IN_PLACE), its final clean-up pass didn't look inside attached shadow roots, so an expression split across pieces could reassemble after sanitizing and later be evaluated by the template engine, which can lead to script execution in the page. Am I affected: - DOMPurify 3.4.4 through 3.4.16, and - you use SAFE_FOR_TEMPLATES: true together with RETURN_DOM, RETURN_DOM_FRAGMENT or IN_PLACE, and - the sanitized output is later processed by a client-side template engine. - String output (the default) is not the affected path. Check the version with npm ls dompurify (it is often pulled in by editors, markdown renderers and charting libraries) and search your code for SAFE_FOR_TEMPLATES. Fix: 1. Upgrade to DOMPurify 3.4.17 or later (npm install dompurify@latest, or update the parent package and your lockfile), then rebuild and redeploy front-end bundles. 2. Until then, use string output for template-bound content, or avoid passing sanitized untrusted HTML into a template engine at all. 3. Defense in depth: don't let template engines compile user-supplied HTML, and use a Content Security Policy that blocks inline script and unsafe-eval. Verify: npm ls dompurify shows 3.4.17+ everywhere (including nested copies), and DOMPurify.version in the browser console of the built app reports the new version. Sources: https://github.com/cure53/DOMPurify/security/advisories/GHSA-cg2g-xh64-v4q7 https://github.com/cure53/DOMPurify/releases/tag/3.4.17 https://github.com/advisories/GHSA-cg2g-xh64-v4q7