CVE-2026-65902

DOMPurify before 3.4.7 affected versions = 3.4.5 passes direct references to the module-level DEFAULTALLOWEDTAGS and DEFAULTALLOWEDATTR sets to the uponSanitizeElement and uponSanitizeAttribute hooks via data.allowedTags / data.allowedAttributes when sanitize is called without an explicit...

PT-2026-63988

DOMPurify before 3.4.7 affected versions = 3.4.5 passes direct references to the module-level DEFAULT ALLOWED TAGS and DEFAULT ALLOWED ATTR sets to the uponSanitizeElement and uponSanitizeAttribute hooks via data.allowedTags / data.allowedAttributes when sanitize is called without an explicit...