{"id":"CVE-2026-61824","sourceIdentifier":"security-advisories@github.com","published":"2026-08-21T21:17:01.017","lastModified":"2026-10-12T16:10:00.220","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Defuddle cleans up HTML pages. Prior to 0.19.1, site extractors interpolate page-derived image alt and src values, og:image values, and video descriptions into HTML strings without context-appropriate escaping, and buildExtractorResponse() returns this contentHtml without the main pipeline's DOM-based sanitization. The affected paths include src/extractors/x-article.ts, src/extractors/substack.ts, and src/extractors/youtube.ts. A malicious page or attacker-controlled content on a matching domain can inject event-handler attributes or javascript URLs that execute when a victim or downstream application renders the extracted HTML. This issue is fixed in version 0.19.1."},{"lang":"es","value":"Defuddle limpia páginas HTML. Antes de 0.19.1, los extractores de sitios interpolan valores alt y src de imágenes derivados de la página, valores og:image y descripciones de video en cadenas HTML sin el escape apropiado para el contexto, y buildExtractorResponse() devuelve este contentHtml sin la sanitización basada en DOM de la canalización principal. Las rutas afectadas incluyen src/extractors/x-article.ts, src/extractors/substack.ts y src/extractors/youtube.ts. Una página maliciosa o contenido controlado por el atacante en un dominio coincidente puede inyectar atributos de gestor de eventos o URLs de javascript que se ejecutan cuando una víctima o aplicación descendente renderiza el HTML extraído. Este problema está solucionado en la versión 0.19.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"kepano","product":"defuddle","versions":[{"version":"< 0.19.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-24T19:48:42.055279Z","id":"CVE-2026-61824","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-116"}]}],"references":[{"url":"https://github.com/kepano/defuddle/commit/baf2eaef61d334ef595b28c89e5c5e89e52daf7f","source":"security-advisories@github.com"},{"url":"https://github.com/kepano/defuddle/pull/326","source":"security-advisories@github.com"},{"url":"https://github.com/kepano/defuddle/releases/tag/0.19.1","source":"security-advisories@github.com"},{"url":"https://github.com/kepano/defuddle/security/advisories/GHSA-jg4p-g6xj-4qmf","source":"security-advisories@github.com"}]}