DOMPurify before 3.3.2 contains a URI validation bypass flaw that is triggered when an attacker supplies a custom predicate function labeled "ADD_ATTR" via the EXTRA_ELEMENT_HANDLING.attributeCheck hook. The predicate can selectively accept particular attribute and tag combinations, which allows dangerous URI schemes such as javascript: to bypass sanitization. When the user activates the element containing the unsanitized URI, the embedded code executes in the browser, resulting in a client‑side cross‑site scripting (XSS) incident. The weakness is a classic reflected injection, identified as CWE‑79.

All releases of the DOMPurify library distributed by cure53 prior to version 3.3.2 are affected. No additional revision or update information is provided beyond the product name; users should verify the current DOMPurify version in use.

The CVSS score of 5.1 indicates moderate risk. The EPSS score is less than 1%, indicating that automated exploitation is currently low. The vulnerability is not listed in the CISA KEV catalog. The description specifies that unsafe protocols survive sanitization and execute when the link is activated. It therefore requires user interaction to trigger the client‑side XSS; an automatic exploit without user action is not possible. Because the flaw operates solely in the client browser and requires that the user activates the malicious link or element, the threat surface is limited to interactions that trigger the element, such as clicking a hyperlink or activating a form input.