CVE-2026-61824: Defuddle HTML Sanitization XSS Vulnerability

CVE-2026-61824 Overview

CVE-2026-61824 is a cross-site scripting (XSS) vulnerability in Defuddle, an open-source library that cleans up HTML pages for reader-style extraction. Versions prior to 0.19.1 interpolate page-derived image alt and src values, og:image values, and video descriptions directly into HTML strings without context-appropriate escaping. The buildExtractorResponse() function returns contentHtml without the main pipeline's DOM-based sanitization. Affected extractor paths include src/extractors/x-article.ts, src/extractors/substack.ts, and src/extractors/youtube.ts. Attackers who control a matching-domain page can inject event-handler attributes or javascript: URLs that execute when downstream applications render the extracted HTML. The issue is tracked as [CWE-79] and fixed in version 0.19.1.

Critical Impact
A malicious or attacker-controlled page can inject executable JavaScript into extracted HTML, resulting in script execution in the context of any downstream application that renders Defuddle output.

Affected Products

Defuddle versions prior to 0.19.1
Applications using the x-article, substack, or youtube site extractors
Downstream tools that render contentHtml returned by buildExtractorResponse()

Discovery Timeline

2026-08-21 - CVE-2026-61824 published to NVD
2026-08-24 - Last updated in NVD database

Technical Details for CVE-2026-61824

Vulnerability Analysis

Defuddle exposes site-specific extractors that build HTML fragments from page metadata such as image alt text, image src values, Open Graph og:image tags, and video descriptions. These extractors concatenate untrusted string values directly into HTML templates. The main Defuddle pipeline normally sanitizes output using DOM-based cleanup, but buildExtractorResponse() bypassed that step and returned the raw contentHtml. Any consumer that inserts this HTML into a live DOM inherits the injected content verbatim.

Because user interaction is required to render extracted content and the impact scope changes to downstream renderers, this vulnerability falls under classic stored or reflected XSS behavior depending on how the extraction result is used.

Root Cause

The root cause is missing context-appropriate output encoding in the affected extractors combined with a sanitization gap in the response builder. String interpolation of page-derived attributes into HTML permitted attackers to break attribute contexts and introduce event handlers such as onerror, onload, or javascript: URI schemes.

Attack Vector

An attacker publishes a page on a domain matched by one of the vulnerable extractors (for example, a Substack post, an X article, or a YouTube video description). The attacker embeds crafted values in image alt, image src, og:image, or video description fields. When a victim application invokes Defuddle against that URL and renders the returned contentHtml, the injected handler executes in the rendering context.

typescript

// Security patch in src/defuddle.ts — Sanitize extractor HTML (#326)
    extractor: BaseExtractor,
    pageMetaTags: MetaTagItem[]
): DefuddleResponse {
-   const contentHtml = this.resolveContentUrls(extracted.contentHtml);
+   const contentHtml = this._sanitizeExtractorHtml(extracted.contentHtml);
    const variables = this.getExtractorVariables(extracted.variables);
    return {
        content: contentHtml,

Source: GitHub Commit baf2eaef

typescript

// Security patch in src/extractors/substack.ts — Sanitize extractor HTML (#326)
import { BaseExtractor } from './_base';
import { ExtractorResult } from '../types/extractors';
-import { parseHTML } from '../utils/dom';
+import { parseHTML, escapeHtml } from '../utils/dom';

const INJECTED_ATTR = 'data-defuddle-substack-post';

Source: GitHub Commit baf2eaef

The fix routes extractor output through _sanitizeExtractorHtml() and introduces escapeHtml in the Substack extractor to encode interpolated values.

Detection Methods for CVE-2026-61824

Indicators of Compromise

Extracted HTML containing inline event handlers such as onerror=, onload=, onclick=, or onmouseover= inside <img> or <video> tags
Image src or anchor href attributes beginning with javascript: in stored extractor output
Unexpected <script> tags or encoded payloads in cached Defuddle responses from Substack, X, or YouTube domains

Detection Strategies

Inventory applications that depend on the defuddle npm package and identify versions below 0.19.1
Scan build manifests, package-lock.json, and container images for vulnerable Defuddle releases
Add DOM sanitization or Content Security Policy (CSP) violation logging around any component that renders contentHtml returned by Defuddle
Review historical extractor output stored in databases or caches for injected handler attributes

Monitoring Recommendations

Log and alert on CSP violations that block inline event handlers or javascript: URIs in views that render extracted articles
Monitor outbound requests from browser sessions rendering extracted content for unusual beacons
Track dependency updates via software composition analysis (SCA) tooling and flag Defuddle versions below 0.19.1

How to Mitigate CVE-2026-61824

Immediate Actions Required

Upgrade Defuddle to version 0.19.1 or later across all applications and build pipelines
Purge or re-sanitize cached extractor output produced by vulnerable versions before serving to users
Apply a strict Content Security Policy that disallows inline scripts and javascript: URIs on pages that render extracted HTML

Patch Information

The maintainers released the fix in Defuddle v0.19.1. The patch introduces _sanitizeExtractorHtml() in src/defuddle.ts and adds escapeHtml usage in the affected extractors. Full technical context is available in the GHSA-jg4p-g6xj-4qmf advisory and the pull request discussion.

Workarounds

Pipe extractor output through a trusted HTML sanitizer such as DOMPurify before rendering
Disable or bypass the x-article, substack, and youtube extractors until the upgrade is applied
Render extracted content inside a sandboxed iframe with sandbox="allow-same-origin" restrictions removed

bash

# Upgrade Defuddle to the patched release
npm install defuddle@0.19.1

# Verify the installed version
npm ls defuddle