DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch)

Moderate severity GitHub Reviewed Published Jun 17, 2026 in cure53/DOMPurify • Updated Jun 18, 2026

No open alerts for this advisory

Give feedback on Dependabot alerts