DOMPurify before version 3.4.17 contains a flaw that permits an attacker to preserve active event handlers when an IN_PLACE hook removes a parent or sibling node. Because markup inserted in detached subtrees is not traversed by the sanitizer, handlers such as img onerror continue to exist after sanitize() returns, leading to DOM‑based cross‑site scripting.

The vulnerability impacts the DOMPurify library from cure53. All releases older than 3.4.17 are affected. Applications that integrate any of these prior versions are therefore susceptible.

The CVSS base score of 5.1 indicates moderate severity. EPSS data is currently unavailable, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread exploitation yet. Attackers can embed malicious markup into any content that passes through DOMPurify; because detached subtrees are not neutralized, event handlers execute after sanitation, enabling a client‑side attack that does not require server‑side privileges.