The CVE describes a cross‑site scripting flaw in DOMPurify when operating in IN_PLACE mode. The sanitizer mistakenly trusts attacker‑controlled nodeName values on live non‑form nodes, allowing an external actor to craft a live DOM object whose nodeName is altered to appear as an allowed element. When the sanitized tree is inserted into the live document, the embedded script executes, giving the attacker code‑execution capability in the user’s context. The weakness maps to input validation and output encoding failure (CWE‑79).

The vulnerability affects the DOMPurify library maintained by cure53. Specifically, usage of DOMPurify version 3.4.6 that renders live DOM objects via IN_PLACE mode is susceptible. No other vendors or products are listed in the CNA impacted set.

The CVSS score of 5.1 indicates a moderate severity. The EPSS score is below 1 %, suggesting a low probability of exploitation in the wild at this time. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to supply a crafted live DOM object to the sanitizer, which generally requires some level of access to the application’s input. If the site renders untrusted HTML using IN_PLACE mode, an exploitation path exists that can execute arbitrary client‑side code.