{"id":"CVE-2026-61824","revision":"bb69474d04ad4242b1d71015ef2f5f62","records":[{"revision":"bb69474d04ad4242b1d71015ef2f5f62","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-61824","aliases":[],"title":"Defuddle:  XSS via unescaped attribute interpolation in site extractors","description":"Defuddle cleans up HTML pages. Prior to 0.19.1, site extractors interpolate page-derived image alt and src values, og:image values, and video descriptions into HTML strings without context-appropriate escaping, and buildExtractorResponse() returns this contentHtml without the main pipeline's DOM-based sanitization. The affected paths include src/extractors/x-article.ts, src/extractors/substack.ts, and src/extractors/youtube.ts. A malicious page or attacker-controlled content on a matching domain can inject event-handler attributes or javascript URLs that execute when a victim or downstream application renders the extracted HTML. This issue is fixed in version 0.19.1.","state":0,"publishedAt":"2026-08-21T20:12:53.225+00:00","modifiedAt":"2026-08-24T19:48:53.974+00:00","affected":[{"ecosystem":"Vendor product","name":"defuddle","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"kepano\",\n                    \"product\": \"defuddle\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 0.19.1\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","score":8.2,"severity":"HIGH"}],"references":["https://github.com/kepano/defuddle/security/advisories/GHSA-jg4p-g6xj-4qmf","https://github.com/kepano/defuddle/pull/326","https://github.com/kepano/defuddle/commit/baf2eaef61d334ef595b28c89e5c5e89e52daf7f","https://github.com/kepano/defuddle/releases/tag/0.19.1"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-61824","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-61824","identifiers":["CVE-2026-61824"]},"retained":false,"historicalAffected":[]}],"coverage":[]}