DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-61784: CVE-2026-61784: HTML Attribute Injection and Sanitizer Bypass in node-xhtml-purifier

#security #cve #cybersecurity

CVE-2026-61784: HTML Attribute Injection and Sanitizer Bypass in node-xhtml-purifier

Vulnerability ID: CVE-2026-61784
CVSS Score: 6.1
Published: 2026-09-24

A critical sanitizer bypass vulnerability exists in the xhtml-purifier Node.js library prior to version 0.4.3. Due to a lack of HTML entity encoding during the attribute re-serialization phase, unauthenticated remote attackers can break out of double-quoted attribute contexts to inject arbitrary script handlers, resulting in Cross-Site Scripting.

TL;DR

The xhtml-purifier library does not encode double quotes in attribute values during re-serialization, allowing attackers to inject malicious HTML attributes like event handlers and execute arbitrary JavaScript.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-79
  • Attack Vector: Network
  • CVSS Score: 6.1 (Medium)
  • EPSS Score: 0.00168
  • Impact: Sanitizer Bypass / Cross-Site Scripting (XSS)
  • Exploit Status: PoC / Functional Tests available
  • CISA KEV Status: Not Listed

Affected Systems

  • Applications utilizing the Node.js package 'xhtml-purifier' for HTML sanitization in versions prior to 0.4.3.
  • xhtml-purifier: < 0.4.3 (Fixed in: 0.4.3)

Code Analysis

Commit: 21d461a

Fix sanitizer bypass by HTML-entity-encoding attribute values before serialization.

Mitigation Strategies

  • Upgrade the xhtml-purifier dependency to version 0.4.3 or higher.
  • Configure WAF rules to intercept and block inputs containing HTML attribute breakouts and event handlers.
  • Implement strong Content Security Policies (CSP) to restrict inline script execution and limit XSS impact.

Remediation Steps:

  1. Run npm audit in the application root directory to identify vulnerable instances of xhtml-purifier.
  2. Update your dependencies in package.json to require xhtml-purifier version ^0.4.3.
  3. Execute npm install to retrieve and apply the patched package versions.
  4. Run regression and security tests with test payloads containing double-quotes within HTML tags to confirm escaping functionality.

References

Read the full report for CVE-2026-61784 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)