DOMPurify versions prior to 3.4.0 allow a state leakage flaw whereby function predicates supplied to ADD_ATTR or ADD_TAGS persist across multiple calls to the same sanitizer instance. When a subsequent sanitize() call supplies an array instead of a function for these options, the previously set function is neither cleared nor overwritten, allowing it to continue approving attacker‑controlled attributes or tags. This persistence permits dangerous event‑handler attributes or forbidden tags that would normally be removed to survive sanitization, resulting in cross‑site scripting when the cleaned content is rendered.

Affected: the DOMPurify library released by Cure53, specifically all versions up to and including 3.3.3. Developers and organizations that embed this client‑side JavaScript library to sanitise user‑supplied HTML in web applications are impacted. No native platform versions are included; the vulnerability exists only in the JavaScript implementation of DOMPurify.

Risk and potential exploitation: The CVSS score of 5.1 classifies the flaw as moderate. The EPSS score of less than 1 % indicates a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need to supply malicious input through repeated calls to the same DOMPurify instance, a scenario that can occur in single‑page applications or frameworks that cache the sanitizer. While the flaw does not allow arbitrary code execution or server compromise, successful exploitation results in cross‑site scripting that can deface the user interface, exfiltrate user data, or hijack sessions if the malicious script has sufficient privileges.