AIKIDO-2026-36958

TL;DR

dompurify configuration and hook handling could allow security-sensitive allowlists to be silently widened and persist across later sanitization calls, weakening the intended filtering behavior. It also accepted attacker-controlled hook entry point keys without verifying they were own properties, creating a prototype pollution risk. Together, these flaws could let unsafe HTML or attributes survive sanitization and lead to DOM-based XSS. An attacker might exploit this by influencing hook registration or sanitizer configuration so that malicious content is treated as allowed, then injecting crafted payloads that execute JavaScript in a victim’s browser.