1 matches found
DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.
Summary There is a possible hook-policy inconsistency in DOMPurify 3.4.11 involving CUSTOMELEMENTHANDLING. When a custom element is allowed via CUSTOMELEMENTHANDLING.tagNameCheck, it appears that the element does not go through afterSanitizeElements in the same way as a normal element. As a resul...
6.1CVSS5.9AI score0.00305EPSS
SaveExploits1References7Affected Software1
20