In DOMPurify 3.4.12, during IN_PLACE sanitization, the _sanitizeElements() function runs hooks such as uponSanitizeElement and returns immediately if the hook detaches the current node. However, it does not call _neutralizeSubtree() on the detached node, leaving any descendant elements with attacker-controlled event handlers executable after sanitize() returns. This detached subtree is not tracked for neutralization, so queued resource events like onload on images can fire, resulting in cross-site scripting (XSS) despite the returned sanitized root being clean and disconnected from the document. The vulnerability requires the non-default IN_PLACE configuration combined with a hook that removes a containing element, but does not add or approve event handlers. A proof-of-concept demonstrates that an image's onload handler fires after sanitization, modifying page content. The suggested fix is to call _neutralizeSubtree() on detached nodes before returning from hook-detachment branches in _sanitizeElements().

An attacker able to supply HTML to an application using DOMPurify with IN_PLACE mode and an element-removal hook can execute arbitrary JavaScript in the application's origin after sanitization. This results in a cross-site scripting (XSS) vulnerability despite the sanitized output appearing clean. The vulnerability affects only the non-default IN_PLACE configuration combined with hooks that remove elements. There are no known exploits in the wild. The impact is moderate due to the specific configuration required and the need for attacker-controlled HTML input.

A patch is available in DOMPurify version 3.4.13 that fixes this issue by ensuring the detached subtree is neutralized before returning from hook-detachment branches. Users should upgrade to version 3.4.13 or later. If upgrading is not immediately possible, avoid using the IN_PLACE configuration with hooks that remove elements until patched. The vendor advisory confirms a fix is available.