PT-2026-63989

DOMPurify before 3.4.0 contains a logic error in the ADD TAGS function where short-circuit evaluation allows forbidden tags to bypass FORBID TAGS restrictions. Attackers can craft input containing tags listed in FORBID TAGS that are also added via ADD TAGS function, causing them to be retained in...