CVE-2026-65898

DOMPurify before 3.4.11 fails to clone the ALLOWEDATTR allowlist when setConfig is used with an uponSanitizeAttribute hook, allowing the hook to permanently mutate the shared allowlist. Attackers can register a hook that conditionally allows dangerous attributes like onerror for trusted elements,...

PT-2026-63984

Name of the Vulnerable Software and Affected Versions DOMPurify versions prior to 3.4.11 Description An issue exists where the software fails to clone the ALLOWED ATTR allowlist when setConfig is used with an uponSanitizeAttribute hook. This allows the hook to permanently mutate the shared...