DOMPurify before version 3.3.2 is vulnerable to prototype pollution when the USE_PROFILES mode is enabled. By adding properties such as onclick to Array.prototype with a truthy value, an attacker tricks the sanitizer into treating event handler attributes as allowlisted. When the altered markup is subsequently rendered, the browser executes the injected script, resulting in a DOM-based cross‑site scripting vulnerability.

The vulnerability affects the DOMPurify library supplied by cure53. All releases older than 3.3.2 that enable the USE_PROFILES feature are potentially impacted. Users who rely on DOMPurify to sanitize user or third‑party content must ensure they are not running a vulnerable version.

The product carries a CVSS score of 5.1, indicating moderate severity, and the EPSS score is reported as less than 1%, implying a low likelihood of widespread exploitation at present. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is client‑side input processed by DOMPurify in USE_PROFILES mode, such as maliciously crafted HTML fragments sent via a web form or embedded content. Attackers would need to embed a profile that pollutes Array.prototype before the sanitizer runs.