DOMPurify is a client‑side sanitizer that removes unsafe markup from user‑supplied content. The vulnerability stems from an inconsistency between the FORBID_TAGS and FORBID_ATTR handling when developers supply a function‑based ADD_TAGS predicate. The short‑circuit logic in the sanitizer skips the FORBID_TAGS check, letting disallowed elements and their attributes remain in the output. As a result, an attacker can inject forbidden tags that execute scripts or perform other malicious actions, constituting a cross‑site scripting issue.

Affected systems include any application that uses the DOMPurify library from cure53 prior to release 3.4.0. This covers all versions older than 3.4.0 that employ function‑based add_tags predicates. The issue is fixed in DOMPurify 3.4.0, so users should verify the library version in their codebase and upgrade accordingly.

The CVSS score is 6, marking the bug as moderate severity. The EPSS score of fewer than 1% indicates a low likelihood of active exploitation at present. The vulnerability is not listed in the KEV catalog. Exploitation is client‑side only, and the attacker would need to supply crafted input that uses a function‑based add_tags predicate to bypass the forbidden tags check and inject malicious markup. The resulting XSS could lead to data theft, session hijacking, or defacement. Prompt patching or removal of vulnerable usage patterns reduces the attack surface.