The vulnerability lies in the IN_PLACE mode of DOMPurify’s sanitize function. Prior to version 3.4.6, calling DOMPurify.sanitize on a <form> element as the root could allow attacker‑controlled event‑handler attributes to persist if a descendant’s name clobbered a property checked by the internal _isClobbered routine. Because the root has no parent, the _forceRemove step is a no‑op and the _sanitizeAttributes routine returns early, the clobbered attributes are not removed. The result is that malicious scripts can remain in the sanitized output and execute in the browser, enabling cross‑site scripting.

DOMPurify, distributed by cure53, versions prior to 3.4.6.

The CVSS score of 6.1 classifies this vulnerability as moderate, while the EPSS score of less than 1% suggests a very low likelihood of exploitation in the wild. It is not listed in the CISA KEV catalog, and the attack requires crafted client‑side code that is sanitised with IN_PLACE mode, making exploitation mainly relevant to developers who include un content in DOMPurify’s IN_PLACE root.