DOMPurify is a DOM‑only cross‑site scripting sanitizer for HTML, MathML, and SVG. In version 3.4.4, DOMPurify allowed selectedcontent by default, allowing browsers to re‑clone an XSS payload after sanitization so that unsanitized markup inside <selectedcontent> is returned. Because the sanitizer does not strip this element, attackers can embed script code that will be executed when the content renders. This flaw is identified as CWE‑79 and may allow arbitrary script injection, compromising confidentiality, integrity, and availability. The issue is fixed in DOMPurify 3.4.5.

Applications that include the DOMPurify library at version 3.4.4 or older, as distributed by cure53, are affected. The bug was addressed in the 3.4.5 release; any deployment still using 3.4.4 or earlier remains vulnerable.

The vulnerability has a CVSS score of 8.2, classifying EPSS score is below 1 %, indicating that real‑world exploitation is currently uncommon, and the bug has not yet been listed in the CISA KEV catalog. The likely attack vector involves a web application that uses DOMPurify to sanitize user input and then renders the sanitized content in a browser that supports the <selectedcontent> element. An attacker can craft payloads containing <selectedcontent> tags, cause the browser to re‑clone the payload, and execute the injected script within the victim’s context.