The vulnerability allows an attacker to exploit DOMPurify’s SAFE_FOR_TEMPLATES bypass when content is inserted into a shadow root using certain modes. By fragmenting a template expression across multiple text nodes separated by elements that are removed during sanitization, the expression is reassembled, is then evaluated by downstream template engines, and can lead to cross‑site scripting. This is a typical client‑side rendering flaw, classified as a cross‑site scripting weakness (CWE‑79).

This issue affects the cure53:DOMPurify library for all releases from 3.4.4 up to but not including 3.4.17. Applications that incorporate DOMPurify in these versions are vulnerable.

With a CVSS score of 5.1 the vulnerability is considered moderate. The EPSS score is not available, and it is not listed in CISA’s KEV catalog. The likely attack vector is that an attacker provides user‑supplied content that is wrapped in a shadow root and processed with the vulnerable modes. If this input reaches the rendering engine, the attacker can achieve arbitrary JavaScript execution in the context of the page.