DOM-based XSS in Stencil Core 4.43.5

Executive Summary

CVE-2026-79320 is a DOM-based cross-site scripting (XSS) vulnerability in Stencil core 4.43.5. It occurs when the experimental slot-fixes option is enabled and scoped components are used. Attacker-controlled data written to a component's host element's textContent property is parsed as HTML instead of plain text, allowing script execution in the application's origin.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Stencil project uses the experimental slot-fixes option and scoped components. Inspect the runtime behavior when writing strings to host elements. No specific commands are provided, but review Stencil configuration files and component code for these settings.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to session hijacking, interface tampering, or disclosure of sensitive information. It does not enable server takeover or system command execution. Exploitation requires specific conditions: experimental slot-fixes enabled, scoped components used, and attacker-controlled data written to host elements.

Useful 0 Not Useful 0

Compliance Impact

This DOM-based XSS vulnerability could lead to unauthorized script execution in the application's origin, potentially enabling attackers to steal sensitive data such as personal information or session tokens. This could violate GDPR's data protection requirements and HIPAA's safeguards for protected health information if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Disable the experimental slot-fixes option in your Stencil configuration. Avoid writing untrusted data directly to host elements' textContent. Escape inputs properly before rendering. Monitor for unusual script execution in the application context.

Useful 0 Not Useful 0