DOMPurify versions prior to 2.4.2 are vulnerable to prototype pollution, which could allow an attacker to tamper with the prototype of base objects. This vulnerability has been assigned CVE-2024-48910 and is rated critical with a CVSS score of 9.1. The issue was fixed in version 2.4.2.