Threats tagged 'ghsa-77h4-4vqj-j7vc'

DOMPurify versions before 3.4.17 contain a cross-site scripting (XSS) vulnerability. This flaw allows attackers to retain event handlers in detached DOM subtrees that are not sanitized, enabling malicious event handlers like img onerror to execute after the sanitize() function completes. The vulnerability arises when an IN_PLACE hook removes a parent or sibling node, leaving attacker-controlled markup unneutralized.