DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig is used with an uponSanitizeAttribute hook, allowing the hook to permanently mutate the shared allowlist. Attackers can register a hook that conditionally allows dangerous attributes such as onerror for trusted elements, then submit untrusted content that inherits the polluted allowlist and executes event handlers as stored XSS.

The vulnerability affects the cure53 DOMPurify library in all versions prior to 3.4.11. Projects that incorporate DOMPurify and use setConfig with an uponSanitizeAttribute hook are at risk. The shared allowlist is shared across instances so any mutation persists for all subsequent sanitizations.

The CVSS score is 5.1, indicating moderate severity, while the EPSS score is less than 1%, suggesting a low probability of exploitation in the data set. It is not listed in the CISA KEV catalog. The likely attack vector involves a web application that sanitizes untrusted content with DOMPurify and allows custom configuration hooks; an attacker can persistently add malicious attributes, resulting in stored XSS after page rendering.