dompurify: DOMPurify: Cross-site scripting via permanent attribute allowlist pollution

A flaw was found in DOMPurify. When the setConfig function is used with an uponSanitizeAttribute hook, the ALLOWEDATTR allowlist is not properly cloned. This allows an attacker to register a hook that can permanently modify the shared allowlist, enabling the conditional allowance of dangerous...

dompurify: DOMPurify: Cross-site scripting via permanent attribute allowlist pollution

A flaw was found in DOMPurify. When the setConfig function is used with an uponSanitizeAttribute hook, the ALLOWEDATTR allowlist is not properly cloned. This allows an attacker to register a hook that can permanently modify the shared allowlist, enabling the conditional allowance of dangerous...

CVE-2026-65898

DOMPurify before 3.4.11 is affected. The vulnerability arises when setConfig() is used with an uponSanitizeAttribute hook and the ALLOWED_ATTR allowlist isn’t cloned, allowing the hook to permanently mutate the shared allowlist. An attacker can register a hook that conditionally permits dangerous...