In DOMPurify versions before 3.4.0, the sanitize() function maintains internal state for predicates supplied as functions via ADD_ATTR or ADD_TAGS. If a subsequent call on the same DOMPurify instance provides ADD_ATTR or ADD_TAGS as arrays instead of functions, the previously set function handlers are not cleared or overwritten. This persistence allows attacker-controlled event-handler attributes or forbidden tags to survive sanitization, effectively bypassing FORBID_TAGS and enabling cross-site scripting (XSS). The vendor Cure53 considers this an edge case outside the primary threat model. The vulnerability is fixed in DOMPurify version 3.4.0.

This vulnerability can allow an attacker to inject malicious scripts by bypassing DOMPurify's sanitization process, potentially leading to cross-site scripting attacks. The impact is limited to scenarios where the same DOMPurify instance is reused with mixed predicate types, which is considered an edge case. The CVSS 4.0 score is 5.1 (medium severity), reflecting network attack vector, low complexity, no privileges required, user interaction needed, and limited scope and impact.

Upgrade DOMPurify to version 3.4.0 or later, where this issue is fixed. The vendor advisory lists 3.4.0 as the patched version. No other official remediation or temporary fixes are documented. Users should avoid reusing the same DOMPurify instance with mixed predicate types as a workaround until upgrading.