dompurify: DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch)
DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch) (moderate). GHSA-cmwh-pvxp-8882, CVE-2026-65898.
osv.devquote checked- security advisory
- Your codeby hand
Nemotron fixes
In its own wordsmatches the page ✓
DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch)
What Teire looks for in your code
nothing to search for: checked by hand
Does it reach your code?