DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p)

影響: npm:dompurify <= 3.4.16 → 3.4.17

The 3.4.16 fix for GHSA-p98j-92pf-mc4p only covers a hook that removes the node it was called for. If an IN_PLACE hook removes a different node, like the current node's parent or a sibling that has not been visited yet, that subtree is never walked or neutralized. Event handlers in it stay on the elements, and an that was already loading fires after sanitize() returns. The README says: "Nodes that a hook detaches from the tree ... are treated as removed. In IN_PLACE mode their subtree is neutra…

GitHub Advisory Databaseで読む

2026/10/23 01:24、GitHub Advisory Databaseが「DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p)」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「重要」(high) です。関連する技術: JavaScript / Node.js。