CVE-2026-79320

Awaiting Analysis Awaiting Analysis - Queue

DOM-based XSS in Stencil Core 4.43.5

Publication date: 2026-09-21

Last updated on: 2026-09-24

Assigner: MITRE

Description

Stencil core 4.43.5 contains a DOM-based cross-site scripting (XSS) vulnerability in the component runtime. When a downstream application enables the experimental slot fixes option and uses scoped components, assigning a string to the textContent property of such a component's host element causes the value to be parsed as HTML instead of being inserted as text. If an application writes attacker-controlled data to these host elements, the data can be interpreted as markup and script can execute in the context of the application's origin.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-21

Last Modified

2026-09-24

Generated

2026-10-12

AI Q&A

2026-09-21

EPSS Evaluated

2026-10-10

NVD

CVE-2026-79320

EUVD

EUVD-2026-84152

Affected Vendors & Products

Vendor	Product	Version / Range
stencil	core	4.43.5

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

CVE-2026-79320 is a DOM-based cross-site scripting (XSS) vulnerability in Stencil core 4.43.5. It occurs when the experimental slot-fixes option is enabled and scoped components are used. Attacker-controlled data written to a component's host element's textContent property is parsed as HTML instead of plain text, allowing script execution in the application's origin.

Detection Guidance

To detect this vulnerability, check if your Stencil project uses the experimental slot-fixes option and scoped components. Inspect the runtime behavior when writing strings to host elements. No specific commands are provided, but review Stencil configuration files and component code for these settings.

Impact Analysis

This vulnerability can lead to session hijacking, interface tampering, or disclosure of sensitive information. It does not enable server takeover or system command execution. Exploitation requires specific conditions: experimental slot-fixes enabled, scoped components used, and attacker-controlled data written to host elements.

Compliance Impact

This DOM-based XSS vulnerability could lead to unauthorized script execution in the application's origin, potentially enabling attackers to steal sensitive data such as personal information or session tokens. This could violate GDPR's data protection requirements and HIPAA's safeguards for protected health information if exploited.

Mitigation Strategies

Disable the experimental slot-fixes option in your Stencil configuration. Avoid writing untrusted data directly to host elements' textContent. Escape inputs properly before rendering. Monitor for unusual script execution in the application context.

Hi! I’m here to help you understand CVE-2026-79320. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70