2vulnerabilities
- Critical0 (0.0%)
- High1 (50.0%)
- Medium0 (0.0%)
- Moderate0 (0.0%)
- Low1 (50.0%)
defuddle
Ecosystem: npm
Downloads:
- 0CriticalAffects 0 versions
- 1HighAffects 1 version
- 0MediumAffects 0 versions
- 0ModerateAffects 0 versions
- 1LowAffects 1 version
Monthly breakdown
- Critical
- High
- Medium
- Moderate
- Low
- 1 vulnerabilities
- Critical: 0
- High: 1
- Medium: 0
- Moderate: 0
- Low: 0
- 1 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 0
- Low: 1
Vulnerabilities (2)
Known vulnerabilities affecting defuddle, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-jg4p-g6xj-4qmf | High | Defuddle vulnerable to XSS via unescaped attribute interpolation in site extractors## Summary An Improper Neutralization of Input During Web Page Generation issue in the site extractor component allows an attacker-controlled attribute value to be injected into output HTML without escaping. An attacker who crafts a malicious HTML page or controls content on a matching domain can execute arbitrary scripts when a victim processes the page, resulting in Cross-Site Scripting (XSS). This affects defuddle through 0.19.0 and has been patched in version 0.19.1. ## Impact This vulnerability allows for Cross-Site Scripting (XSS) execution without needing to compromise external webs |
| GitHub (opens in a new tab) | |
| GHSA-5mq8-78gm-pjmq | Low | defuddle vulnerable to XSS via unescaped string interpolation in _findContentBySchemaText image tag### Summary The `_findContentBySchemaText` method in `src/defuddle.ts` interpolates image `src` and `alt` attributes directly into an HTML string without escaping: ```typescript html += `<img src="${imageSrc}" alt="${imageAlt}">`; ``` An attacker can use a `"` in the `alt` attribute to break out of the attribute context and inject event handlers. This is a separate vulnerability from the sanitization bypass fixed in f154cb7 — the injection happens during string construction, not in the DOM, so `_stripUnsafeElements` cannot catch it. ### Details When `_findContentBySchemaText` finds a sibl |
| GitHub (opens in a new tab) |
- GHSA-jg4p-g6xj-4qmfHighDefuddle vulnerable to XSS via unescaped attribute interpolation in site extractors
< 0.19.1
## Summary An Improper Neutralization of Input During Web Page Generation issue in the site extractor component allows an attacker-controlled attribute value to be injected into output HTML without escaping. An attacker who crafts a malicious HTML page or controls content on a matching domain can execute arbitrary scripts when a victim processes the page, resulting in Cross-Site Scripting (XSS). This affects defuddle through 0.19.0 and has been patched in version 0.19.1. ## Impact This vulnerability allows for Cross-Site Scripting (XSS) execution without needing to compromise external webs
CVE: CVE-2026-61824
- GHSA-5mq8-78gm-pjmqLowdefuddle vulnerable to XSS via unescaped string interpolation in _findContentBySchemaText image tag
< 0.9.0
### Summary The `_findContentBySchemaText` method in `src/defuddle.ts` interpolates image `src` and `alt` attributes directly into an HTML string without escaping: ```typescript html += `<img src="${imageSrc}" alt="${imageAlt}">`; ``` An attacker can use a `"` in the `alt` attribute to break out of the attribute context and inject event handlers. This is a separate vulnerability from the sanitization bypass fixed in f154cb7 — the injection happens during string construction, not in the DOM, so `_stripUnsafeElements` cannot catch it. ### Details When `_findContentBySchemaText` finds a sibl
CVE: CVE-2026-30830