DOMPurify libraries between versions 3.4.13 and 3.4.15 fail to neutralize subtrees removed by afterSanitizeElements or afterSanitizeAttributes hooks during IN_PLACE sanitization. The flaw allows attackers to embed on* event handlers inside markup that is subsequently wrapped and removed by these hooks, leaving the event handlers attached to the live DOM. When the sanitized content is then inserted into a page, the retained handlers can execute arbitrary JavaScript in the victim’s browser context, enabling remote code execution within the originating domain.

Products from cure53 using the DOMPurify library, specifically library versions 3.4.13, 3.4.14, and 3.4.15, are affected. The vulnerability is confined to the IN_PLACE sanitization mode and applies to any deployment that relies on custom afterSanitizeElements or afterSanitizeAttributes hooks.

CVSS base score is 5.1, indicating moderate severity, and no EPSS score is available. The vulnerability is not listed in the CISA KEV catalog. The attack requires an attacker to supply malicious markup that is processed through DOMPurify in IN_PLACE mode, where custom hooks detach marked‑up subtrees. An attacker who can influence the content passed to the sanitizer—such as a web application that accepts user‑generated content—can trigger the XSS. The exploit path is client‑side, so the impact is limited to browsers that load the vulnerable library, but any user rendering the content risks running attacker code. Given the moderate CVSS, potential for exploitation is considered low to moderate, yet the impact can be significant if an application places the library in a public‑facing context.