So I'm not informed about this particular case, but DOMPurify does work correctly AFAIK. It's an old project though and I've always refrained from using it in

So I'm not informed about this particular case, but DOMPurify does work correctly AFAIK. It's an old project though and I've always refrained from using it in favor of sanitizing user input in other ways (or letting library code do it for me). It might be that they used this library wrong. It might also be that it's more of a research project. There's a reason I guess that none of the popular UI frameworks/libraries have DOMPurify as a dep. It boils down to a separation similar to prepared statements. Disallowing direct string interpolation into DOM subtrees is the way to go, esp when user-controlled data is involved. You can't achieve XSS by assigning .textContent on a DOM node, for example. That's why the DOM API is a thing and innerHTML is equivalent to eval regarding security.