CVE-2026-61824: Defuddle vulnerable to XSS via unescaped attribute interpolation in site extractors
An Improper Neutralization of Input During Web Page Generation issue in the site extractor component allows an attacker-controlled attribute value to be injected into output HTML without escaping. An attacker who crafts a malicious HTML page or controls content on a matching domain can execute arbitrary scripts when a victim processes the page, resulting in Cross-Site Scripting (XSS). This affects defuddle through 0.19.0 and has been patched in version 0.19.1.
References
- github.com/advisories/GHSA-jg4p-g6xj-4qmf
- github.com/kepano/defuddle/commit/baf2eaef61d334ef595b28c89e5c5e89e52daf7f
- github.com/kepano/defuddle/pull/326
- github.com/kepano/defuddle/releases/tag/0.19.1
- github.com/kepano/defuddle/security/advisories/GHSA-jg4p-g6xj-4qmf
- nvd.nist.gov/vuln/detail/CVE-2026-61824
Code Behaviors & Features
Detect and mitigate CVE-2026-61824 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →