{"id":"EUVD-2026-64132","enisaUuid":"a1a5a653-3f82-3a67-95d0-776789c630a8","description":"Defuddle cleans up HTML pages. Prior to 0.19.1, site extractors interpolate page-derived image alt and src values, og:image values, and video descriptions into HTML strings without context-appropriate escaping, and buildExtractorResponse() returns this contentHtml without the main pipeline\u0027s DOM-based sanitization. The affected paths include src/extractors/x-article.ts, src/extractors/substack.ts, and src/extractors/youtube.ts. A malicious page or attacker-controlled content on a matching domain can inject event-handler attributes or javascript URLs that execute when a victim or downstream application renders the extracted HTML. This issue is fixed in version 0.19.1.","datePublished":"Aug 21, 2026, 8:12:53 PM","dateUpdated":"Aug 24, 2026, 7:48:53 PM","baseScore":8.2,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","references":"https://github.com/kepano/defuddle/security/advisories/GHSA-jg4p-g6xj-4qmf\nhttps://github.com/kepano/defuddle/pull/326\nhttps://github.com/kepano/defuddle/commit/baf2eaef61d334ef595b28c89e5c5e89e52daf7f\nhttps://github.com/kepano/defuddle/releases/tag/0.19.1\n","aliases":"CVE-2026-61824\nGHSA-jg4p-g6xj-4qmf\n","assigner":"GitHub_M","epss":0.41,"enisaIdProduct":[{"id":"d7612973-8881-3775-a74d-d6f0564b097c","product":{"name":"defuddle","vendor":{"name":"kepano"}},"product_version":"\u003c 0.19.1"}],"enisaIdVendor":[{"id":"ad5e921e-fb2a-3e7e-9b4b-be960b6093cb","vendor":{"name":"kepano"}}],"enisaIdVulnerability":[{"id":"51f5d987-22dc-3904-8f2a-4233344f8b2b","vulnerability":{"id":"GHSA-jg4p-g6xj-4qmf","description":"Defuddle vulnerable to XSS via unescaped attribute interpolation in site extractors","datePublished":"Aug 21, 2026, 8:54:56 PM","dateUpdated":"Aug 21, 2026, 8:54:56 PM","baseScore":0.0,"references":"https://github.com/kepano/defuddle/security/advisories/GHSA-jg4p-g6xj-4qmf\nhttps://github.com/kepano/defuddle/pull/326\nhttps://github.com/kepano/defuddle/commit/baf2eaef61d334ef595b28c89e5c5e89e52daf7f\nhttps://github.com/kepano/defuddle\nhttps://github.com/kepano/defuddle/releases/tag/0.19.1\n","enisa_id":"EUVD-2026-64132\n","aliases":"GHSA-jg4p-g6xj-4qmf\nCVE-2026-61824\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:04:29 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"ea18e328-998c-3f7b-aff2-fad04f5c7747","vulnerability":{"id":"CVE-2026-61824","description":"Defuddle cleans up HTML pages. Prior to 0.19.1, site extractors interpolate page-derived image alt and src values, og:image values, and video descriptions into HTML strings without context-appropriate escaping, and buildExtractorResponse() returns this contentHtml without the main pipeline\u0027s DOM-based sanitization. The affected paths include src/extractors/x-article.ts, src/extractors/substack.ts, and src/extractors/youtube.ts. A malicious page or attacker-controlled content on a matching domain can inject event-handler attributes or javascript URLs that execute when a victim or downstream application renders the extracted HTML. This issue is fixed in version 0.19.1.","datePublished":"Aug 21, 2026, 8:12:53 PM","dateUpdated":"Aug 24, 2026, 7:48:53 PM","status":"PUBLISHED","baseScore":8.2,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","references":"https://github.com/kepano/defuddle/security/advisories/GHSA-jg4p-g6xj-4qmf\nhttps://github.com/kepano/defuddle/pull/326\nhttps://github.com/kepano/defuddle/commit/baf2eaef61d334ef595b28c89e5c5e89e52daf7f\nhttps://github.com/kepano/defuddle/releases/tag/0.19.1\n","enisa_id":"EUVD-2026-64132\n","assigner":"GitHub_M","epss":0.41,"dataProcessed":"Nov 7, 2026, 7:18:43 AM","vulnerabilityProduct":[{"id":"5e2f91ba-39b8-3114-80a2-2094409d1d59","product":{"name":"defuddle","vendor":{"name":"kepano"}},"product_version":"\u003c 0.19.1"}],"vulnerabilityVendor":[{"id":"5834421f-272d-359c-ae38-b487530bfd48","vendor":{"name":"kepano"}}]}}],"enisaIdAdvisory":[]}