PT-2026-63992

DOMPurify before 3.3.2 contains a URI validation bypass vulnerability when ADD ATTR is provided as a predicate function via EXTRA ELEMENT HANDLING.attributeCheck. Attackers can supply a predicate that accepts specific attribute and tag combinations to bypass URI-safe validation, allowing unsafe...