CVE-2026-61824: High-Severity Cross-Site Scripting (XSS) via Unsanitized Site Extractors in Defuddle
Vulnerability ID: CVE-2026-61824
CVSS Score: 8.2
Published: 2026-08-21
CVE-2026-61824 is a high-severity Cross-Site Scripting (XSS) vulnerability in kepano/defuddle before version 0.19.1. Custom site extractors for platforms such as X/Twitter, Substack, and YouTube constructed HTML representations via template string interpolation without output escaping. This allowed malicious pages to bypass standard parser sanitization routines and execute arbitrary JavaScript.
TL;DR
Unsanitized input interpolation in site extractors allows remote attackers to execute arbitrary client-side JavaScript via crafted page metadata.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-79
- Attack Vector: Network
- CVSS Score: 8.2 (High)
- Exploit Status: Proof-of-Concept in tests
- KEV Status: Not Listed
- Ransomware Use: No
Affected Systems
- kepano/defuddle applications scraping Twitter, Substack, or YouTube
-
defuddle: < 0.19.1 (Fixed in:
0.19.1)
Code Analysis
Commit: baf2eae
Fix extractor XSS vulnerabilities by escaping interpolated attribute values and routing site extractor HTML through the central DOM sanitizer pass.
@@ -1692,14 +1692,37 @@ export class Defuddle {
...
+ private _sanitizeExtractorHtml(html: string): string {
+ if (!html) return html;
+ const container = this.doc.createElement('div');
+ container.appendChild(parseHTML(this.doc, html));
+ this._stripUnsafeElements(container);
+ this.resolveRelativeUrls(container);
+ return serializeHTML(container);
+ }
Mitigation Strategies
- Upgrade defuddle to version 0.19.1 or higher.
- Implement mandatory downstream HTML sanitization using DOMPurify or sanitize-html.
- Enforce a strict Content Security Policy (CSP) blocking inline scripts.
Remediation Steps:
- Run 'npm install defuddle@0.19.1' or update package.json dependencies.
- Locate all locations in the codebase where Defuddle's output is rendered into the DOM.
- Wrap the output rendering block in a robust sanitization function call.
- Verify that inline events like 'onerror' and 'onclick' are fully stripped.
References
- GHSA-jg4p-g6xj-4qmf: XSS via unescaped attribute interpolation in site extractors
- GitHub Pull Request #326
- Defuddle v0.19.1 Release
Read the full report for CVE-2026-61824 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)