DOMPurify is a sanitizer for HTML, MathML, and SVG that prevents XSS attacks. Versions before 3.4.7 have a vulnerability in the IN_PLACE sanitization process that can omit sanitizing shadow DOM content attached to elements inside <template>.content. This flaw allows malicious code to survive sanitization and execute in the context of the application when the sanitized template is cloned and inserted into the DOM. The vulnerability is identified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The fix was introduced in version 3.4.7.

An attacker can inject malicious scripts or event handlers that bypass sanitization and execute in the victim's browser, potentially leading to cross-site scripting attacks. This can compromise user data, session tokens, or perform unauthorized actions within the affected web application. The CVSS 4.0 score is 6.3 (medium severity), indicating a moderate risk with network attack vector and no privileges required but user interaction needed.

Upgrade DOMPurify to version 3.4.7 or later, where this vulnerability is fixed. No other mitigation is specified or required as the issue is resolved in the official patch.