What’s Vulnerable › Vulnerabilities

CVE-2026-61824: Defuddle: XSS via unescaped attribute interpolation in site extractors

• Severity: high (CVSS 8.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-21 · updated 2026-10-12
• Weakness: CWE-79

Description

Defuddle cleans up HTML pages. Prior to 0.19.1, site extractors interpolate page-derived image alt and src values, og:image values, and video descriptions into HTML strings without context-appropriate escaping, and buildExtractorResponse() returns this contentHtml without the main pipeline's DOM-based sanitization. The affected paths include src/extractors/x-article.ts, src/extractors/substack.ts, and src/extractors/youtube.ts. A malicious page or attacker-controlled content on a matching domain can inject event-handler attributes or javascript URLs that execute when a victim or downstream application renders the extracted HTML. This issue is fixed in version 0.19.1.

Affected products

• kepano defuddle: before 0.19.1

References

• https://github.com/kepano/defuddle/commit/baf2eaef61d334ef595b28c89e5c5e89e52daf7f
• https://github.com/kepano/defuddle/pull/326
• https://github.com/kepano/defuddle/releases/tag/0.19.1
• https://github.com/kepano/defuddle/security/advisories/GHSA-jg4p-g6xj-4qmf

Get alerted when CVE-2026-61824 or the next vulnerability affects your stack