CVE-2026-49978 is a cross-site scripting vulnerability in DOMPurify, a library used to sanitize HTML, MathML, and SVG to prevent XSS attacks. The vulnerability arises when DOMPurify performs in-place sanitization and fails to properly handle shadow DOM content within <template>.content elements. This oversight enables attackers to embed malicious JavaScript code that executes when the sanitized template is used by an application. Red Hat OpenShift Virtualization products that incorporate DOMPurify for sanitization are affected. The vulnerability impacts confidentiality and integrity by allowing unauthorized code execution and potential information disclosure. The vendor advisory classifies the severity as important and high but does not currently provide a confirmed patch or fix. Red Hat scores the vulnerability with a CVSS vector indicating network attack vector, low complexity, no privileges required, user interaction required, and high confidentiality and integrity impact.

The vulnerability allows attackers to inject and execute malicious JavaScript code in affected Red Hat OpenShift Virtualization products that use DOMPurify for sanitization. This can lead to unauthorized actions within the application context and disclosure of sensitive information such as user cookies or session data. The flaw compromises confidentiality and integrity but does not impact availability. The vulnerability is rated as high severity by Red Hat and is classified under CWE-79 (Cross-site Scripting). There are no known exploits in the wild at this time.

The vendor advisory does not explicitly confirm the availability of a patch or fix for this vulnerability. Users should monitor Red Hat's official advisories for updates and apply all previously released errata relevant to their systems before applying any new updates. Since this is a vulnerability in a third-party library (DOMPurify), consider updating to a fixed version of DOMPurify (3.4.7 or later) if possible within your environment. Follow Red Hat's guidance on applying updates as detailed in their knowledge base article https://access.redhat.com/articles/11258. No specific temporary mitigations are provided in the advisory.