DOMPurify, a widely used DOM‑only XSS sanitizer, contains a prototype‑pollution flaw that allows an attacker to inject custom regex patterns into Object.prototype. When an application calls DOMPurify.sanitize() with its default settings, the overridden tagNameCheck and attributeNameCheck functions permit arbitrary custom elements and attributes, including event handlers, to pass through sanitization. The result is an XSS vector that can execute malicious scripts in the user’s browser, compromising confidentiality and integrity of client‑side data.

The vulnerability affects the cure53 library DOMPurify versions 3.0.1 through 3.3.3. Versions 3.4.0 and later contain a fix that removes the prototype‑pollution path.

The CVSS score of 6.9 rates the vulnerability as moderate severity, while the EPSS score of less than 1% indicates a low likelihood of widespread exploitation. The flaw is not listed in the CISA KEV catalog. Based on the description, it is inferred that attackers must first achieve prototype pollution to place malicious regexes in Object.prototype before a DOMPurify.sanitize() call occurs. Based on the description, it is inferred that this typically requires a preceding vulnerability or vulnerability chain in the target application, making the attack vector indirect and contingent on prior conditions.