CVE-2026-79320
Stencil core 4.43.5 contains a DOM-based cross-site scripting (XSS) vulnerability in the component runtime. When a downstream application enables the experimental slot fixes option and uses scoped components, assigning a string to the textContent property of such a component's host element causes the value to be parsed as HTML instead of being inserted as text. If an application writes attacker-controlled data to these host elements, the data can be interpreted as markup and script can execute in the context of the application's origin.
- Score
- CVSS 3.1 6.1 Medium
- Status
- Awaiting Analysis - cve@mitre.org
- Published
- 2026-09-21
- Last modified
- 2026-09-24
- Weaknesses
- CWE-79
References
- https://github.com/lichoin/TraceLoom/blob/main/CVEs/CVE-2026-79320.md
- https://github.com/stenciljs/core
