DOMPurify is a DOM‑only cross‑site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.7, DOMPurify IN_PLACE sanitization could skip shadow contents attached to an element inside a <template>.content, allowing attacker‑controlled markup such as event handlers, JavaScript URLs, or scripts to survive sanitization. When an application clones and inserts the sanitized template, the embedded malicious code can execute, resulting in arbitrary JavaScript execution. This flaw is a CWE‑79 vulnerability due to improper neutralization of input during page generation. This issue is fixed in version 3.4.7.

The affected product is DOMPurify, managed by the cure53 CNA. All releases older than 3.4.7 are vulnerable, including versions 3.4.6 and earlier. No other vendors or products are listed in the advisory.

The CVSS score is 6.3, indicating moderate severity. The EPSS score is below 1%, suggesting a low probability of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires an attacker to supply malicious markup containing an attached shadow root within a <template> element, rely on an application that performs IN_PLACE sanitization followed by cloning and insertion of the template, and then trigger the embedded code. Because the flaw bypasses sanitization of the shadow root, the contained script or event handlers can execute when the template is rendered.