xhtml-purifier has HTML attribute-injection (sanitizer bypass) that leads to XSS

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-61784 · Microsoft / collected KEV context

EUVD-2026-86325

GHSA-j8r4-32c5-33rc

cve-program · CVE-2026-61784

• https://github.com/cstigler/node-xhtml-purifier/security/advisories/GHSA-j8r4-32c5-33rc
• https://github.com/cstigler/node-xhtml-purifier/commit/21d461ad23e7bc9b3073693d5b51b9b8662044d3

euvd · EUVD-2026-86325

• https://github.com/cstigler/node-xhtml-purifier/security/advisories/GHSA-j8r4-32c5-33rc
• https://github.com/cstigler/node-xhtml-purifier/commit/21d461ad23e7bc9b3073693d5b51b9b8662044d3

nvd · CVE-2026-61784

• https://github.com/cstigler/node-xhtml-purifier/commit/21d461ad23e7bc9b3073693d5b51b9b8662044d3
• https://github.com/cstigler/node-xhtml-purifier/security/advisories/GHSA-j8r4-32c5-33rc

osv · GHSA-j8r4-32c5-33rc

• https://github.com/cstigler/node-xhtml-purifier/security/advisories/GHSA-j8r4-32c5-33rc
• https://nvd.nist.gov/vuln/detail/CVE-2026-61784
• https://github.com/cstigler/node-xhtml-purifier/pull/6
• https://github.com/cstigler/node-xhtml-purifier/commit/21d461ad23e7bc9b3073693d5b51b9b8662044d3
• https://github.com/cstigler/node-xhtml-purifier
• https://github.com/cstigler/node-xhtml-purifier/releases/tag/v0.4.3

No related operational record is retained in the current change model.