DOMPurify is a sanitizer for HTML, MathML, and SVG to prevent XSS attacks. Versions before 3.4.6 have a vulnerability where the sanitize function, when called with the IN_PLACE option on same-origin foreign-realm DOM nodes, fails certain instanceof checks for forms, named node maps, document fragments, and elements. This failure causes the sanitizer to skip critical sanitization branches related to clobbering, template content, and shadow DOM, allowing executable markup to survive the sanitization process. The vulnerability is addressed in DOMPurify version 3.4.6.

An attacker can exploit this vulnerability to inject executable markup that bypasses DOMPurify's sanitization, potentially leading to cross-site scripting (XSS) attacks. This can result in partial compromise of confidentiality and integrity of affected web applications. The CVSS score of 6.1 reflects a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, scope change, and low impact on confidentiality and integrity.

Upgrade DOMPurify to version 3.4.6 or later, where this vulnerability is fixed. No other mitigations are indicated or required as the fix addresses the root cause.