CVE-2026-61784
Received Received - Intake

XSS Sanitizer Bypass in xhtml-purifier Library

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: GitHub, Inc.

Description
xhtml-purifier is a Node.js library to take in raw/unknown/untrusted HTML and output cleaned, purified, trusted HTML. Versions prior to 0.4.3 do not HTML-entity-encode attribute values when serializing its sanitized output. In attributeString() (XHTMLPurifier.js, around line 148) the attribute value is concatenated directly into a double-quoted attribute without encoding. As a result, an attacker-controlled value in any allowed attribute (class, style, title, alt, src, href) can include a double-quote character to break out of the attribute and inject an additional attribute, such as a JavaScript event handler (for example onmouseover or onerror). The injected handler survives sanitization and executes when the output is rendered, which is a sanitizer bypass leading to cross-site scripting. The fix in version 0.4.3 HTML-entity-encodes attribute values before serialization.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-24
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-61784
EUVD
EUVD-2026-86325

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-116 The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

xhtml-purifier is a Node.js library that sanitizes untrusted HTML input. Versions before 0.4.3 fail to encode attribute values properly during output serialization. This allows attackers to inject double-quote characters into attribute values, breaking out of the attribute context and adding malicious event handlers like onmouseover or onerror. These handlers execute when the sanitized output is rendered, bypassing the sanitizer and enabling cross-site scripting (XSS).

Detection Guidance

To detect this vulnerability, inspect any applications using xhtml-purifier versions prior to 0.4.3. Check for unsanitized HTML output containing unencoded double quotes in attributes like class, style, or href. Review server logs for unusual JavaScript event handlers in user-controlled input fields.

Impact Analysis

If you use a vulnerable version of xhtml-purifier, attackers could inject malicious scripts into your web pages. This could lead to unauthorized actions on behalf of users, data theft, or defacement of your website. Users visiting your site might have their sessions hijacked or be redirected to malicious sites.

Compliance Impact

This vulnerability could lead to data breaches, exposing personal or sensitive data. Under GDPR, this may result in fines for inadequate data protection. For HIPAA, it could violate safeguards for protected health information, leading to penalties. Compliance requires addressing vulnerabilities to protect user data and maintain trust.

Mitigation Strategies

Upgrade xhtml-purifier to version 0.4.3 or later immediately. If upgrading is not possible, implement additional input validation and output encoding at the application level to prevent attribute breakout and JavaScript injection.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-61784. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart