DOMPurify versions earlier than 3.4.13 allow an attacker to place event handler attributes on descendant elements inside HTML that is sanitized with the IN_PLACE strategy. The element‑removal hooks in DOMPurify fail to neutralize detached subtrees, so the returned root appears clean while the event handlers can still fire. This flaw permits arbitrary client‑side code execution and can lead to data theft, session hijacking, or other malicious actions in the victim’s browser. The weakness corresponds to CWE‑79, a classic Cross‑Site Scripting issue.

The vulnerability affects all installations of DOMPurify from cure53 before version 3.4.13, regardless of the host platform or environment.

The CVSS score of 5.1 classifies the flaw as medium severity. EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is client‑side injection: an attacker who can supply or influence the HTML passed to DOMPurify can trigger the flaw by embedding malicious event handlers or detached subtrees. Exploitation requires that the affected application uses the default IN_PLACE sanitization with element‑removal hooks enabled.