EUVD-2026-84152
GHSA-pm76-9f64-vwpc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious HTML/script payload
-
DeliveryDeliver via app input sunk to host textContent
-
ExploittextContent parsed as HTML in scoped component
-
ExecutionVictim loads page (UI:R)
-
ImpactScript executes in application origin
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitable only when the downstream Stencil application (Stencil core 4.43.5) enables the experimental 'slot fixes' option AND uses scoped components AND writes attacker-controlled data to such a component host element's textContent property, where the value is then parsed as HTML rather than inserted as text. Limiting factors: the experimental slot-fixes option is non-default configuration, scoped-component usage is required, the application must contain a data sink into host textContent, and successful attack requires victim user interaction (UI:R) to load the malicious content. These conditions substantially narrow the exposed population below what the AV:N/PR:N metrics suggest. |
| Impact | Signals converge on a genuine-but-low-priority issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N = 6.1 MEDIUM) reflects a classic reflected/DOM-XSS profile: network-reachable, no privileges, but requiring victim user interaction and yielding only partial confidentiality/integrity impact via script execution in the app origin. EPSS is very low at 0.14% (4th percentile), CISA SSVC scores Exploitation: none / Automatable: no / Technical Impact: partial, and the CVE is NOT in KEV - all consistent with no active exploitation. Crucially, exploitation is gated on TWO non-default preconditions that CVSS does not capture: the downstream application must (a) enable the experimental 'slot fixes' option AND use scoped components, and (b) actually sink attacker-controlled data into a scoped component host element's textContent. This makes the real-world exposed population far smaller than the network-vector score implies. One reference (lichoin/TraceLoom) is a researcher writeup that may contain proof-of-concept detail but is not a confirmed weaponized exploit; treat POC status as unconfirmed. Net: legitimate library-level defect worth patching in affected Stencil-based apps, but not an urgent, widely-exploitable priority. |
| Exploit ScenarioDerived | A Stencil-based web application has the experimental 'slot fixes' option enabled and renders user-supplied data (e.g., a profile name or comment) into a scoped component's host element via textContent. An attacker submits a payload containing HTML/script markup; because textContent is parsed as HTML under this defect, the markup renders and script executes in the victim's browser in the application's origin when the victim views the page. A researcher writeup (TraceLoom) exists but no confirmed weaponized exploit or active exploitation is identified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 24, 2026
DOM-based cross-site scripting in StencilJS core 4.43.5 allows an attacker-controlled string to be parsed as HTML and executed as script in a downstream application's origin, but only when that application has enabled the experimental slot-fixes option, uses scoped components, and writes untrusted data to the textContent property of such a component's host element. The flaw is remotely reachable without credentials (AV:N/PR:N) yet requires victim user interaction (UI:R) and a non-default configuration, and the independent assessment concludes the exposed population is substantially narrower than the raw metrics suggest. No public exploit code or confirmed active exploitation has been identified at time of analysis, and EPSS is 0.14% (4th percentile), indicating low predicted likelihood of exploitation.
RemediationAI
No vendor-released patch identified at time of analysis; monitor https://github.com/stenciljs/core and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-79320 for a fixed Stencil core release, then upgrade and re-test slot rendering behavior. Without a confirmed fix, the highest-leverage mitigation is to disable the experimental slot-fixes option in the Stencil configuration and rebuild - the trade-off is that the slot-rendering defects the flag was introduced to work around may reappear in affected components. If the flag must stay enabled, stop assigning untrusted strings to the textContent of scoped component host elements and instead insert text nodes or run values through an HTML-allowlisting sanitizer such as DOMPurify at the point of assignment, noting that sanitization must happen client-side because the value is consumed by the runtime in the browser. A strict Content-Security-Policy that excludes 'unsafe-inline' blocks the resulting script execution but can break applications relying on inline scripts or inline styles. Given the low EPSS (0.14%), the absence of observed exploitation, and the requirement for a non-default configuration, these changes can be scheduled through normal release cycles rather than treated as an emergency, but first inventory which downstream applications both enable slot fixes and sink user data into host textContent.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
StencilJS is a compiler and runtime for building standards-based web components (custom elements with shadow DOM and slots), and CVE-2026-79320 is a DOM-based XSS (CWE-79, improper neutralization of input during web page generation) that lives in the component runtime rather than in developer-authored template code. When the experimental 'slot fixes' option is enabled, the runtime's handling of property assignments on a scoped component's host element diverges from normal text semantics: assigning a string to host.textContent causes the value to be parsed as HTML markup instead of being inserted as literal text, so embedded tags or event-handler attributes are interpreted by the browser. Because the sink is a DOM property assignment processed by the runtime's own insertion logic, the flaw is not visible to ordinary template-level sanitization review, and the supplied CPE string (cpe:2.3:a:n/a:n/a) is an uninformative placeholder - the real affected artifact is the Stencil core 4.43.5 package as consumed by downstream applications.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Standard DOM-XSS: network-reachable with no attacker privileges but victim interaction required (UI:R); script escaping into the app origin is a scope change (S:C) with partial C/I and no availability impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
Stencil core 4.43.5 contains a DOM-based cross-site scripting (XSS) vulnerability in the component runtime. When a downstream application enables the experimental slot fixes option and uses scoped components, assigning a string to the textContent property of such a component's host element causes the value to be parsed as HTML instead of being inserted as text. If an application writes attacker-controlled data to these host elements, the data can be interpreted as markup and script can execute in the context of the application's origin.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Exploit-DB