GHSA-j8r4-32c5-33rcPublished
xhtml-purifier has HTML attribute-injection (sanitizer bypass) that leads to XSS
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-61784 · CVE overview and exploitation status
cve-program · CVE-2026-61784
- https://github.com/cstigler/node-xhtml-purifier/security/advisories/GHSA-j8r4-32c5-33rc
- https://github.com/cstigler/node-xhtml-purifier/commit/21d461ad23e7bc9b3073693d5b51b9b8662044d3
euvd · EUVD-2026-86325
- https://github.com/cstigler/node-xhtml-purifier/security/advisories/GHSA-j8r4-32c5-33rc
- https://github.com/cstigler/node-xhtml-purifier/commit/21d461ad23e7bc9b3073693d5b51b9b8662044d3
nvd · CVE-2026-61784
- https://github.com/cstigler/node-xhtml-purifier/commit/21d461ad23e7bc9b3073693d5b51b9b8662044d3
- https://github.com/cstigler/node-xhtml-purifier/security/advisories/GHSA-j8r4-32c5-33rc
osv · GHSA-j8r4-32c5-33rc
- https://github.com/cstigler/node-xhtml-purifier/security/advisories/GHSA-j8r4-32c5-33rc
- https://nvd.nist.gov/vuln/detail/CVE-2026-61784
- https://github.com/cstigler/node-xhtml-purifier/pull/6
- https://github.com/cstigler/node-xhtml-purifier/commit/21d461ad23e7bc9b3073693d5b51b9b8662044d3
- https://github.com/cstigler/node-xhtml-purifier
- https://github.com/cstigler/node-xhtml-purifier/releases/tag/v0.4.3
Related changes
Linked by CVE identifierNo related changes are available here.