The vulnerability is a logic error in the ADD_TAGS function of DOMPurify, where short‑circuit evaluation allows tags listed in FORBID_TAGS to slip through the filter. This flaw involves CWE‑697 and CWE‑79. When an attacker supplies such a tag, it is added to the output, potentially introducing malicious content such as scripts. Based on the description, it is inferred that if the FORBID_TAGS list includes script tags, this could lead to cross‑site scripting when sanitized user input is rendered in a browser.

The affected product is the DOMPurify library from cure53, versions prior to 3.4.0. Any web application that depends on those versions and uses the ADD_TAGS function is potentially vulnerable.

The CVSS base score of 5.1 shows a moderate severity, and the EPSS value of less than 1% indicates a low probability of exploitation at the time of this analysis. The vulnerability is not listed in CISA’s KEV catalog. Exploitability requires the attacker to supply crafted input processed by a vulnerable instance of DOMPurify; no network‑reachable vulnerability is disclosed, so the attack surface is limited to environments that accept user‑generated content. Based on the description, it is inferred that the presence of script tags in the FORBID_TAGS list could enable XSS attacks.