A flaw in DOMPurify 3.1.3 through 3.3.1 and 2.5.3 through 2.5.8 allows an attacker to insert JavaScript into attribute values that bypass normal sanitization. By crafting payloads such as </noscript><img src=x onerror=alert(1)>, the attacker can cause code execution when the output is later placed inside rawtext elements – noscript, xmp, noembed, noframes, or iframe – where attribute sanitization is not enforced.

This vulnerability affects the DOMPurify library distributed by cure53. Affected versions include 3.1.3 through 3.3.1 and 2.5.3 through 2.5.8. Any web application that integrates these releases and outputs sanitized HTML into rawtext contexts is potentially impacted.

The CVSS score of 5.3 indicates moderate severity. EPSS is below 1 % and the issue is not listed in the CISA KEV catalog, suggesting limited exploitation activity to date. The likely attack vector involves an attacker providing malicious input to a web application that uses DOMPurify to sanitize that input before rendering it inside rawtext elements. Successful exploitation would enable the attacker to run JavaScript in the victim’s browser session, compromising confidentiality, integrity, or other aspects of the application or user data.