DOMPurify versions prior to 3.4.12 contain a flaw that prevents the afterSanitizeElements hook from running on custom elements permitted by the CUSTOM_ELEMENT_HANDLING.tagNameCheck setting. As a result, attributes set on those elements remain untouched and can later be re‑injected into innerHTML sinks, enabling an attacker to create a second‑order XSS gadget. The vulnerability is a classic Cross‑Site Scripting flaw (CWE‑79).

The affected library is DOMPurify from cure53. Vulnerable versions include all releases before 3.4.12. The library is widely used in web applications for sanitizing HTML. No vendor version list is provided beyond the cutoff; administrators should examine any deployment of DOMPurify earlier than 3.4.12.

The CVSS score of 5.1 indicates a moderate severity. The EPSS score of less than 1% suggests low current exploitation probability, and the vulnerability is not listed in CISA KEV. The attack is client‑side, requiring an attacker to supply crafted input that is later injected into the browser’s innerHTML, thus leading to XSS. While exploitation may not be widespread, any application that sanitizes input with a vulnerable DOMPurify version is at risk of subsequent script execution if custom element attributes survive sanitization.