CVE-2026-55886: Html Sanitizer Blocklist By Selectorcve-2026-55886-html-sanitizer-blocklist-by-selector
The code relies on blocklisting specific HTML tags or attributes (such as `[onerror]` or `[href^=javascript]`) to sanitize untrusted input. This approach is inherently incomplete and easily bypassed by attackers using different executable constructs (e.g., `srcdoc`, `formaction`, data URIs). To properly sanitize HTML, use a well-tested library like DOMPurify
