From 8b9846be4ee981041e64bd03a85e2c9863d13fba Mon Sep 17 00:00:00 2001
From: Inverle <inverle@proton.me>
Date: Fri, 16 Jan 2026 16:41:37 +0100
Subject: [PATCH] Don't preserve children inside disallowed `<template>`
 element

---
 src/Sanitize.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/Sanitize.php b/src/Sanitize.php
index df1176b75..9918a5171 100644
--- a/src/Sanitize.php
+++ b/src/Sanitize.php
@@ -697,7 +697,7 @@ protected function enforce_allowed_html_nodes(\DOMNode $element, bool $allow_dat
             $parent = $element->parentNode;
             if (!in_array($tag, ['html', 'head', 'body', 'div'], true)
                 && !isset($this->allowed_html_elements_with_attributes[$tag])) {
-                if (!in_array($tag, ['script', 'style', 'svg', 'math'], true)) {
+                if (!in_array($tag, ['script', 'style', 'svg', 'math', 'template'], true)) {
                     // Preserve children inside the disallowed element
                     for ($i = $element->childNodes->length - 1; $i >= 0; $i--) {
                         $child = $element->childNodes->item($i);