CVE-2026-61824High· 8.2▾ TwilightDefuddle cleans up HTML pages. Prior to 0.19.1, site extractors interpolate page-derived image alt and src values, og:image values, and video descriptions into HTML strings without context-appropriate escaping, and buildExtractorResponse…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 45.1 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 22.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
0.2% → 0.4%
Last analysed / modified upstream
Defuddle cleans up HTML pages. Prior to 0.19.1, site extractors interpolate page-derived image alt and src values, og:image values, and video descriptions into HTML strings without context-appropriate escaping, and buildExtractorResponse() returns this contentHtml without the main pipeline's DOM-based sanitization. The affected paths include src/extractors/x-article.ts, src/extractors/substack.ts, and src/extractors/youtube.ts. A malicious page or attacker-controlled content on a matching domain can inject event-handler attributes or javascript URLs that execute when a victim or downstream application renders the extracted HTML. This issue is fixed in version 0.19.1.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
defuddle <= 0.19.0Patched in:
defuddle 0.19.1Connected by shared product, vendor, weakness, or advisory.
CVE-2026-12048Critical· 9.3Stored cross-site scripting in pgAdmin 4's error-rendering and plan-node-rendering paths
CVE-2026-12047Low· 3.5HTML injection in pgAdmin 4's cloud deployment module
CVE-2026-118257High· 7.2Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages
CVE-2026-118256LowVue I18n: `escapeParameter` does not escape named values when the same call also passes a list
CVE-2026-116582Medium· 4.7Seroval: Script injection through RegExp sources in serialized output
CVE-2026-110725Low· 3.7fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references