{"id":"CVE-2026-61824","title":"Defuddle cleans up HTML pages","summary":"Defuddle cleans up HTML pages. Prior to 0.19.1, site extractors interpolate page-derived image alt and src values, og:image values, and video descriptions into HTML strings without context-appropriate escaping, and buildExtractorResponse…","severity":"high","cvss":8.2,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","cwe":["CWE-79","CWE-116"],"vendor":"defuddle","product":"defuddle","affected":["defuddle <= 0.19.0"],"patched":["defuddle 0.19.1"],"published":"2026-08-21","updated":"2026-10-12","sourceUpdated":"2026-10-12T16:10:00.220","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-61824","references":[{"url":"https://github.com/kepano/defuddle/commit/baf2eaef61d334ef595b28c89e5c5e89e52daf7f","label":"security-advisories@github.com"},{"url":"https://github.com/kepano/defuddle/pull/326","label":"security-advisories@github.com"},{"url":"https://github.com/kepano/defuddle/releases/tag/0.19.1","label":"security-advisories@github.com"},{"url":"https://github.com/kepano/defuddle/security/advisories/GHSA-jg4p-g6xj-4qmf","label":"security-advisories@github.com"},{"url":"https://github.com/advisories/GHSA-jg4p-g6xj-4qmf"}],"tags":["nvd","ghsa","npm"],"epss":0.0041,"epssPercentile":0.35061,"aliases":["GHSA-jg4p-g6xj-4qmf"],"ecosystem":"npm","ingestedAt":"2026-08-21T21:22:19.700Z","slug":"CVE-2026-61824","body":"## Overview\n\nDefuddle cleans up HTML pages. Prior to 0.19.1, site extractors interpolate page-derived image alt and src values, og:image values, and video descriptions into HTML strings without context-appropriate escaping, and buildExtractorResponse() returns this contentHtml without the main pipeline's DOM-based sanitization. The affected paths include src/extractors/x-article.ts, src/extractors/substack.ts, and src/extractors/youtube.ts. A malicious page or attacker-controlled content on a matching domain can inject event-handler attributes or javascript URLs that execute when a victim or downstream application renders the extracted HTML. This issue is fixed in version 0.19.1.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-61824)\n\nAffected packages:\n\n- `defuddle <= 0.19.0`\n\nPatched in:\n\n- `defuddle 0.19.1`\n\nSource: https://github.com/advisories/GHSA-jg4p-g6xj-4qmf","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":45.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}