Stencil core 4.43.5 contains a DOM‑based cross‑site scripting flaw in the component runtime. When the experimental slot fixes option is enabled and scoped components are used, assigning a string to the textContent property of a component’s host element causes the value to be parsed as HTML. If an attacker can control that string, malicious markup or script will execute in the context of the application’s origin. The vulnerability allows attackers to run arbitrary client‑side code by injecting scripts that execute in the application's origin context.

Any application that incorporates Stencil core 4.43.5, enables the experimental slot fixes option, and uses scoped components is affected. The issue is limited to the runtime behavior of Stencil; other parts of the framework are not directly impacted.

The CVSS score is 6.1 and the EPSS score is < 1%. The vulnerability is not listed in the CISA KEV catalog. Attackers can inject script tags or other executable markup via the component host element, which will run with the privileges of the application. No special conditions are stated, so any downstream application that follows the described configuration pattern can be exploited.