Security Bulletin: Carbon chart DOMPurify XSS Vulnerabilities (CVE-2026-109344, CVE-2026-109345)

Summary DOMPurify was updated to address two cross-site scripting vulnerabilities CVE-2026-109344, CVE-2026-109345 affecting versions prior to 3.4.16. Both vulnerabilities involve the INPLACE mode failing to fully neutralize malicious markup: CVE-2026-109344 leaves event handlers armed on the liv...