Rikuxx0

**Name of the Vulnerable Software and Affected Versions** DOMPurify versions prior to 3.4.12 **Description** DOMPurify fails to execute the `afterSanitizeElements` hook for custom elements that are permitted through `CUSTOM ELEMENT HANDLING.tagNameCheck`. This allows attributes to bypass application security policies, enabling attackers to preserve sensitive attributes on custom elements. These attributes can subsequently be re-injected into `innerHTML` sinks, resulting in second-order Cross-Site Scripting (XSS) gadgets. XSS is a type of attack where malicious scripts are injected into trusted websites. **Recommendations** Update to version 3.4.12 or later.