DOMPurify before version 3.4.11 fails to clone the ALLOWED_ATTR allowlist when the setConfig() method is used alongside an uponSanitizeAttribute hook. This improper neutralization allows the hook to mutate the shared allowlist permanently. An attacker can exploit this by registering a hook that conditionally permits dangerous attributes such as onerror for trusted elements. Subsequently, when untrusted content is sanitized, it inherits the polluted allowlist, enabling execution of event handlers as stored cross-site scripting (XSS). This vulnerability affects DOMPurify versions prior to 3.4.11.

An attacker can exploit this vulnerability to execute stored cross-site scripting attacks by injecting malicious event handlers into sanitized content. This can lead to the execution of arbitrary scripts in the context of the affected web application, potentially compromising user data or session integrity. The issue arises from the permanent mutation of the shared allowlist, which undermines the sanitization process.

Upgrade DOMPurify to version 3.4.11 or later, where this vulnerability is fixed by properly cloning the ALLOWED_ATTR allowlist when using setConfig() with an uponSanitizeAttribute hook. No other mitigation is recommended as the fix addresses the root cause.