DOMPurify is a sanitizer for HTML, MathML, and SVG to prevent XSS attacks. Versions before 3.4.7 have a vulnerability in the IN_PLACE sanitization method that can omit sanitizing shadow DOM contents attached inside <template>.content elements. This omission allows malicious markup, including event handlers, JavaScript URLs, or scripts, to persist and execute in the context of the application when the sanitized template is cloned and inserted into the DOM. The vulnerability is addressed by the fix in version 3.4.7.

An attacker can inject malicious scripts or event handlers that survive sanitization and execute in the victim's browser, potentially leading to cross-site scripting attacks. This can result in unauthorized script execution, data theft, or other client-side impacts. The CVSS 4.0 score is 6.3 (medium severity), indicating a moderate risk without requiring privileges or user interaction beyond viewing the affected content.

Upgrade DOMPurify to version 3.4.7 or later, where this vulnerability is fixed. No other mitigation is indicated or required as the issue is resolved in the official patch.