DOMPurify fails to sanitize <template> with shadow DOM, XSS bypass

DOMPurify fails to sanitize content inside <template> elements that contain shadow DOM, allowing XSS payloads to bypass sanitization.

Applications using DOMPurify to sanitize HTML that may include <template> elements with shadow DOM.

Review your use of DOMPurify and apply any available patches or workarounds to prevent XSS via <template> and shadow DOM.