DOMPurify versions older than 3.3.2 suffer a mutation‑XSS flaw in which sanitized HTML that is later re‑inserted into special parsing contexts (such as script, xmp, iframe, noembed, noframes, or noscript) can be crafted with closing delimiters to break out of the wrapper during reparsing. The resulting reactivation of dangerous markup, including event handlers, allows an attacker to execute arbitrary JavaScript in the victim’s browser, compromising the integrity and confidentiality of the web application and its users. This is a classic DOM‑based injection flaw labeled CWE‑79.

Any installation of cure53:DOMPurify published before version 3.3.2 is affected. Applications that embed this library and subsequently insert sanitized content into the special wrapper contexts enumerated above are at risk. The vulnerability does not apply to later releases of the library.

The CVSS score of 5.3 indicates a medium severity, while the EPSS score of less than 1% suggests a very low current exploitation likelihood. The issue is not listed in the CISA KEV catalog, further implying limited publicly documented active exploitation. Attackers would need to supply sanitized input that is later re‑inserted into one of the vulnerable wrapper contexts via innerHTML. The attack vector is therefore DOM‑based XSS and is limited to environments that perform such re‑insertion. Nonetheless, achieving arbitrary script execution can lead to session hijacking, data theft, or defacement.