AIKIDO-2026-904917

TL;DR

When DOMPurify.sanitize receives a DocumentFragment whose child is a shadow host, it moves the fragment's children into an internal working body and leaves the fragment empty before sanitizing. The attached shadow root traversal then runs from the now empty fragment instead of the working body, so the child host's open shadow root is never scanned. Content inside that shadow root, including a javascript: URL or event handler, is returned unsanitized when a DOM fragment is requested. The fix runs the attached shadow root traversal from the working body so hosts moved out of the fragment are still sanitized.