CVE-2026-65902 DOMPurify before 3.4.7 Hook Mutation Pollution via allowedTags

DOMPurify before 3.4.7 passes direct references to the module-level DEFAULTALLOWEDTAGS and DEFAULTALLOWEDATTR sets to the uponSanitizeElement and uponSanitizeAttribute hooks via data.allowedTags / data.allowedAttributes when sanitize is called without an explicit cfg.ALLOWEDTAGS / cfg.ALLOWEDATTR...