CVE-2026-61824: Defuddle vulnerable to XSS via unescaped attribute interpolation in site extractors
An Improper Neutralization of Input During Web Page Generation issue in the site extractor component allows an attacker-controlled attribute value to be injected into output HTML without escaping. An attacker who crafts a malicious HTML page or controls content on a matching domain can execute arbitrary scripts when a victim processes the page, resulting in Cross-Site Scripting (XSS). This affects defuddle through 0.19.0 and has been patched in version 0.19.1.
References
- github.com/advisories/GHSA-jg4p-g6xj-4qmf
- github.com/kepano/defuddle/commit/baf2eaef61d334ef595b28c89e5c5e89e52daf7f
- github.com/kepano/defuddle/pull/326
- github.com/kepano/defuddle/releases/tag/0.19.1
- github.com/kepano/defuddle/security/advisories/GHSA-jg4p-g6xj-4qmf
- nvd.nist.gov/vuln/detail/CVE-2026-61824
Code Behaviors & Features
Detect and mitigate CVE-2026-61824 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →