p PatchFirst

CVE-2026-30830

CVE-2026-30830 · Defuddle: XSS via unescaped string interpolation in _findContentBySchemaText image tag

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Defuddle cleans up HTML pages. Prior to version 0.9.0, the _findContentBySchemaText method in src/defuddle.ts interpolates image src and alt attributes directly into an HTML string without escaping. An attacker can use a " in the alt attribute to break out of the attribute context and inject event handler. This issue has been patched in version 0.9.0.

CVSS 2.1 · Low · EPSS 0.3% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • defuddle

    Versions
    • < 0.9.0: Affected

    No fix published

  • defuddle npm

    Affected ranges
    • SEMVER: < 0.9.0

    Update to 0.9.0

Original sources

Check your server →