DOMPurify versions prior to 3.4.12 fail to execute the afterSanitizeElements hook for custom elements that are permitted through the CUSTOM_ELEMENT_HANDLING.tagNameCheck mechanism. This failure allows attributes on these custom elements to bypass the intended application security policies. As a result, attackers can maintain sensitive attributes on these elements, which may later be re-inserted into innerHTML sinks, creating opportunities for second-order cross-site scripting (XSS) attacks. The vulnerability has a CVSS 4.0 base score of 5.1, indicating a medium severity level.

The vulnerability allows attackers to bypass DOMPurify's sanitization for certain custom elements, preserving sensitive attributes that can be re-injected into the DOM. This can lead to second-order XSS attacks, potentially enabling the execution of malicious scripts in the context of the affected web application. However, there are no known exploits in the wild at this time.

Upgrade DOMPurify to version 3.4.12 or later, where this issue is fixed. Patch status is not explicitly confirmed in the vendor advisory, but the affected versions are clearly stated as those before 3.4.12, indicating that 3.4.12 includes the fix. No other mitigation or temporary workaround is provided.