H-T-M

**Name of the Vulnerable Software and Affected Versions** DOMPurify versions prior to 3.4.16 **Description** An issue exists where the `IN PLACE` mode returns a force-removed `style` element that still contains markup within its text content, allowing a bypass of the sanitization process. This occurs because the ` neutralizeSubtree()` function only strips attributes from removed subtrees and fails to neutralize the rawtext content of elements like `style`. An attacker can provide a `style` element containing a closing tag and a malicious payload, such as an `img` element with an `onerror` handler. The script executes when the application serializes the returned node and re-parses it in an HTML context (for example, via `innerHTML` assignment). **Recommendations** Update to version 3.4.16 or later. As a temporary mitigation, avoid using the `IN PLACE: true` configuration when calling `DOMPurify.sanitize()` if the resulting node is intended to be serialized and re-parsed.