DOMPurify, a widely used client‑side sanitization library, contains a bug in versions up to and including 3.3.3 that fails to sanitize DOM elements when they are passed to the internal IN_PLACE mode from a different JavaScript realm, such as an iframe’s contentDocument. The private _isNode() function performs a cross‑realm instanceof check that returns false for foreign‑realm nodes, causing the element to be stringified as "[object HTMLDivElement]" and the IN_PLACE flag to be silently reset. Consequently, the function returns the unsanitized element unchanged, allowing any embedded XSS payload to remain active and execute in the host page. This flaw effectively disables DOMPurify’s core protection against client‑side script injection, opening the door for attackers to run arbitrary JavaScript in the victim’s context.

DOMPurify provided by cure53, versions up to and including 3.3.3. Any deployment that uses IN_PLACE mode with DOM nodes originating from another window or iframe is susceptible.

The CVSS score of 2.3 indicates a low overall impact, and an EPSS score of less than 1% suggests a correspondingly low likelihood of exploitation in the wild. The flaw is not listed in the CISA KEV catalog. The likely attack vector involves an attacker controlling or injecting content into an iframe or foreign realm and then passing that DOM element to DOMPurify in IN_PLACE mode. Because the vulnerability requires direct manipulation of the DOM from a separate window, it may limit the ease of exploitation, but any environment that relies on DOMPurify for security is advised to address the issue promptly.