{"id":"CVE-2026-61824","revision":"ff0924b28b7a410da8016b7d548e383c","records":[{"revision":"ff0924b28b7a410da8016b7d548e383c","observedAt":"2026-10-25T14:19:28.838+00:00","statement":{"source":"nvd","id":"CVE-2026-61824","aliases":[],"title":"Defuddle cleans up HTML pages. Prior to 0.19.1, site extractors interpolate page-derived image alt and src values, og:image values, and video descriptions into HTML strings without context-appropriate escaping, and buildExtractorResponse() …","description":"Defuddle cleans up HTML pages. Prior to 0.19.1, site extractors interpolate page-derived image alt and src values, og:image values, and video descriptions into HTML strings without context-appropriate escaping, and buildExtractorResponse() returns this contentHtml without the main pipeline's DOM-based sanitization. The affected paths include src/extractors/x-article.ts, src/extractors/substack.ts, and src/extractors/youtube.ts. A malicious page or attacker-controlled content on a matching domain can inject event-handler attributes or javascript URLs that execute when a victim or downstream application renders the extracted HTML. This issue is fixed in version 0.19.1.","state":0,"publishedAt":"2026-08-21T21:17:01.017+00:00","modifiedAt":"2026-10-12T16:10:00.22+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","score":8.2,"severity":"HIGH"}],"references":["https://github.com/kepano/defuddle/commit/baf2eaef61d334ef595b28c89e5c5e89e52daf7f","https://github.com/kepano/defuddle/pull/326","https://github.com/kepano/defuddle/releases/tag/0.19.1","https://github.com/kepano/defuddle/security/advisories/GHSA-jg4p-g6xj-4qmf"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-61824","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-79","CWE-116"],"productCriteria":[],"sourceDates":{"published":"2026-08-21T21:17:01.017","lastModified":"2026-10-12T16:10:00.220"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-61824","identifiers":["CVE-2026-61824"]},"retained":false,"historicalAffected":[]}],"coverage":[]}