DOMPurify is a sanitizer for HTML, MathML, and SVG to prevent XSS. Before version 3.4.6, using DOMPurify.sanitize(root, { IN_PLACE: true }) on a <form> root element could preserve event-handler attributes if a descendant element's name clobbered properties checked by the internal _isClobbered function. This occurred because _forceRemove did not operate on the parent-less root and _sanitizeAttributes returned early, allowing malicious event handlers to remain. This vulnerability is addressed in DOMPurify 3.4.6.

An attacker controlling the root <form> element could inject event-handler attributes that are not removed, enabling cross-site scripting attacks. This can lead to limited confidentiality and integrity impacts via script execution in the context of the affected web page. The CVSS score is 6.1 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low confidentiality and integrity impact.

Upgrade DOMPurify to version 3.4.6 or later, where this vulnerability is fixed. No other official remediation or temporary fixes are documented. Users should avoid using vulnerable versions with the IN_PLACE option on root <form> elements until patched.