TI-2026-44249 Aliases CVE-2026-61824 GHSA-jg4p-g6xj-4qmf

Defuddle: XSS via unescaped attribute interpolation in site extractors

LOW 36CWE-116Published 2026-08-21 · Updated 2026-08-24

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: High · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Defuddle cleans up HTML pages. Prior to 0.19.1, site extractors interpolate page-derived image alt and src values, og:image values, and video descriptions into HTML strings without context-appropriate escaping, and buildExtractorResponse() returns this contentHtml without the main pipeline's DOM-based sanitization. The affected paths include src/extractors/x-article.ts, src/extractors/substack.ts, and src/extractors/youtube.ts. A malicious page or attacker-controlled content on a matching domain can inject event-handler attributes or javascript URLs that execute when a victim or downstream application renders the extracted HTML. This issue is fixed in version 0.19.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0041 35th percentileScored 2026-11-07

Fix Fixed defuddle (kepano): 0.19.1defuddle (npm): 0.19.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
kepano	defuddle	before 0.19.1	0.19.1	Patch available	CNA
—	defuddle (npm)	before 0.19.1	0.19.1	Patch available	GHSA-jg4p-g6xj-4qmf

defuddle Vendorkepano Affected before 0.19.1 Fixed in 0.19.1 Patch available CNA
defuddle (npm) Vendor— Affected before 0.19.1 Fixed in 0.19.1 Patch available GHSA-jg4p-g6xj-4qmf

Remediation

Fix · CNA defuddle (kepano) Fixed in 0.19.1
Fix · GHSA-jg4p-g6xj-4qmf defuddle (npm) Fixed in 0.19.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-61824
2026-10-03 Alias added: GHSA-jg4p-g6xj-4qmf

References

Other 5

TI-2026-23659 Defuddle: XSS via unescaped string interpolation in _findContentBySchemaText image tag CVSS 4.0LOW 2.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences