DOMPurify before version 3.4.16 contains a cross‑site scripting weakness that defeats the library’s sanitization logic. In IN_PLACE mode the library returns a DOM node that has had style elements force‑removed, but the raw text content of those elements remains in the node. An attacker can craft a style element that ends the style tag early and inserts an image tag with an onerror handler. When the sanitized node is later serialized and parsed by the application, the onerror payload is executed, inserting arbitrary JavaScript into the victim’s browser.

The flaw impacts any installation that uses the open‑source DOMPurify library from cure53 prior to version 3.4.16 and employs the IN_PLACE mode of sanitization. Web applications that accept user‑supplied content, sanitize it with DOMPurify and then re‑serialize or re‑parse the result are at risk. All releases of DOMPurify before 3.4.16 are considered vulnerable unless the library is disabled or patched.

The vulnerability scores a moderate CVSS of 5.1, and no EPSS information is available, so the current exploitation probability is not quantifiable. It is not listed in the CISA KEV catalog, implying no known public exploitation yet. The attack requires the application to re‑serialize or re‑parse the sanitized node, meaning an attacker must supply suitable input that passes the initial sanitization. When this condition is satisfied, arbitrary client‑side code can run, potentially compromising user sessions, leaking data, or defacing the site.