dompurify: DOMPurify: Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently pollutes `DEFAULT_ALLOWED_TAGS` / `DEFAULT_ALLOWED_ATTR`
DOMPurify: Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently pollutes `DEFAULT_ALLOWED_TAGS` / `DEFAULT_ALLOWED_ATTR` (moderate). GHSA-76mc-f452-cxcm, CVE-2026-65902.
osv.devquote checked- security advisory
- Your codeby hand
Nemotron fixes
In its own wordsmatches the page ✓
DOMPurify: Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently pollutes `DEFAULT_ALLOWED_TAGS` / `DEFAULT_ALLOWED_ATTR`
What Teire looks for in your code
nothing to search for: checked by hand
Does it reach your code?