DOMPurify is a sanitizer for HTML, MathML, and SVG to prevent XSS attacks. Before version 3.4.6, the sanitize function with the IN_PLACE option accepted same-origin foreign-realm DOM nodes, but subsequent checks used parent-realm constructors. This mismatch caused instanceof checks for forms, named node maps, document fragments, and elements to fail, skipping critical sanitization branches related to clobbering, template content, and shadow DOM. As a result, executable markup could remain in sanitized content, leading to potential XSS vulnerabilities. The vulnerability is resolved in DOMPurify version 3.4.6.

An attacker could exploit this vulnerability to inject executable markup that survives sanitization, potentially leading to cross-site scripting attacks. This could result in limited confidentiality and integrity impacts, such as executing malicious scripts in the context of the affected web application. The CVSS score of 6.1 reflects a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, and scope changed.

Upgrade DOMPurify to version 3.4.6 or later, where this vulnerability is fixed. There is no indication of alternative mitigations or temporary fixes. Users should ensure they do not use vulnerable versions with the IN_PLACE option on same-origin foreign-realm DOM nodes.