Critical
ghsa-cg2g-xh64-v4q7
DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes
A bypass in DOMPurify's template expression sanitization allows split expressions within attached shadow roots to survive element stripping in DOM-returning modes. If an application evaluates sanitized shadow root content, an attacker supplying a shadow root can achieve cross-site scripting or template injection.