AIKIDO-2026-925458

TL;DR

DOMPurify can sanitize existing DOM nodes in place when the IN_PLACE option is enabled. When a sanitization hook removes a containing element, the sanitizer returns early without neutralizing that element's now-detached descendants, so a descendant such as an image keeps an already-armed event handler. The returned root looks clean, but the retained handler still runs after sanitize() returns once the pending resource event fires. The fix neutralizes the detached subtree before returning from the hook-removal path so queued handlers are stripped.