The vulnerability stems from the demo's afterSanitizeElements hook in hooks-target-blank-demo.html. This hook added 'target="_blank"' to links but did not include the 'rel="noopener noreferrer"' attribute, which is critical to prevent reverse tabnabbing. The patch explicitly adds this attribute in the same hook, confirming the vulnerable code location. The core DOMPurify library is not inherently vulnerable; the issue was specific to the demo's example implementation.