CVE-2026-61824

Received Received - Intake

Stored XSS in Defuddle HTML Page Extractor

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description

Defuddle cleans up HTML pages. Prior to 0.19.1, site extractors interpolate page-derived image alt and src values, og:image values, and video descriptions into HTML strings without context-appropriate escaping, and buildExtractorResponse() returns this contentHtml without the main pipeline's DOM-based sanitization. The affected paths include src/extractors/x-article.ts, src/extractors/substack.ts, and src/extractors/youtube.ts. A malicious page or attacker-controlled content on a matching domain can inject event-handler attributes or javascript URLs that execute when a victim or downstream application renders the extracted HTML. This issue is fixed in version 0.19.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-21

Last Modified

2026-08-21

Generated

2026-08-22

AI Q&A

2026-08-22

EPSS Evaluated

N/A

NVD

CVE-2026-61824

EUVD

EUVD-2026-64132

Affected Vendors & Products

Vendor	Product	Version / Range
defuddle	defuddle	0.19.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-116	The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

Attack-Flow Graph

Executive Summary

This vulnerability involves Defuddle, a tool that cleans up HTML pages. Before version 0.19.1, it fails to properly escape certain HTML attributes and values extracted from pages, such as image alt text, src values, og:image, and video descriptions. This allows malicious content to inject executable code like event handlers or JavaScript URLs into the extracted HTML.

Detection Guidance

This vulnerability involves improperly escaped HTML content in Defuddle versions prior to 0.19.1. Detection requires checking installed versions of Defuddle and inspecting HTML output for unescaped event-handler attributes or javascript URLs. No specific commands are provided in the context.

Impact Analysis

If you use Defuddle prior to version 0.19.1, attackers could inject malicious scripts into extracted HTML content. When this content is rendered by you or downstream applications, the scripts could execute, potentially leading to data theft, unauthorized actions, or other malicious activities.

Mitigation Strategies

Immediately upgrade Defuddle to version 0.19.1 or later to address the vulnerability. Review and sanitize any extracted HTML content before rendering to prevent injection of malicious scripts or event handlers.

Hi! I’m here to help you understand CVE-2026-61824. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70