PT-2026-63984

DOMPurify before 3.4.11 fails to clone the ALLOWED ATTR allowlist when setConfig is used with an uponSanitizeAttribute hook, allowing the hook to permanently mutate the shared allowlist. Attackers can register a hook that conditionally allows dangerous attributes like onerror for trusted elements...