DOMPurify before version 3.4.12 fails to execute the afterSanitizeElements hook for custom elements permitted through the CUSTOM_ELEMENT_HANDLING.tagNameCheck mechanism. This failure allows attributes on these custom elements to bypass application security policies. Attackers can exploit this to preserve sensitive attributes on custom elements, which may later be re-injected into innerHTML sinks, creating second-order XSS gadgets. The vulnerability is identified as CWE-79 (Improper Neutralization of Input During Web Page Generation).

The vulnerability allows attackers to bypass security policies by preserving attributes on allowed custom elements, which can lead to second-order XSS attacks when these attributes are re-inserted into the DOM via innerHTML. This can result in partial compromise of confidentiality and integrity but does not affect availability. The CVSS score is 6.1 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and scope changed with limited confidentiality and integrity impact.

A fix is available in DOMPurify version 3.4.12. Users should upgrade to version 3.4.12 or later to ensure the afterSanitizeElements hook is properly executed for custom elements allowed via CUSTOM_ELEMENT_HANDLING.tagNameCheck. No other mitigation is indicated.