DOMPurify versions >=3.0.0 and <3.4.9 do not reset the retained Trusted Types policy upon calling clearConfig(). This means that if a DOMPurify instance is reused across different trust boundaries, it remains bound to a previously set TRUSTED_TYPES_POLICY. When a later caller requests RETURN_TRUSTED_TYPE output, the TrustedHTML object returned is created by the old policy rather than a clean default. Additionally, passing TRUSTED_TYPES_POLICY: null on the later call does not clear the retained policy. This behavior can result in script execution at a Trusted Types sink due to the use of an unsafe policy.

The vulnerability allows script execution at a Trusted Types sink by returning TrustedHTML objects created by an old, potentially unsafe Trusted Types policy. This undermines the protection mechanism intended by Trusted Types policies, potentially enabling cross-site scripting (XSS) or similar script injection attacks when DOMPurify instances are reused across trust boundaries.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid reusing DOMPurify instances across different trust boundaries or explicitly ensure that the Trusted Types policy is properly reset. Passing TRUSTED_TYPES_POLICY: null does not clear the retained policy, so this approach is ineffective. Monitor vendor communications for updates and apply patches once released.