CVE-2026-65902

DOMPurify 3.4.7 fixes a mutation pollution vulnerability. Affected: DOMPurify

EUVD-2026-48271

DOMPurify before 3.4.7 affected versions = 3.4.5 passes direct references to the module-level DEFAULTALLOWEDTAGS and DEFAULTALLOWEDATTR sets to the uponSanitizeElement and uponSanitizeAttribute hooks via data.allowedTags / data.allowedAttributes when sanitize is called without an explicit...

PT-2026-63988

DOMPurify before 3.4.7 affected versions = 3.4.5 passes direct references to the module-level DEFAULT ALLOWED TAGS and DEFAULT ALLOWED ATTR sets to the uponSanitizeElement and uponSanitizeAttribute hooks via data.allowedTags / data.allowedAttributes when sanitize is called without an explicit...