CVE-2026-61824: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in kepano defuddle

The vulnerability in kepano defuddle (CVE-2026-61824) involves improper neutralization of input during web page generation (CWE-79). Prior to version 0.19.1, defuddle's site extractors interpolate image alt and src attributes, og:image values, and video descriptions into HTML strings without appropriate escaping. Additionally, the function buildExtractorResponse() returns this contentHtml without applying the main pipeline's DOM-based sanitization. Affected extractor paths include src/extractors/x-article.ts, src/extractors/substack.ts, and src/extractors/youtube.ts. This flaw enables an attacker controlling content on a matching domain or a malicious page to inject event-handler attributes or javascript: URLs that execute upon rendering, leading to potential cross-site scripting attacks. The vulnerability is resolved in version 0.19.1.

Successful exploitation can lead to execution of attacker-controlled JavaScript in the context of the victim or downstream application rendering the extracted HTML. This can result in partial confidentiality loss (C), limited integrity impact (I), and no availability impact (A), as reflected by the CVSS vector. The vulnerability is remotely exploitable without privileges and requires user interaction.

Upgrade to kepano defuddle version 0.19.1 or later, where this vulnerability is fixed. The fix involves proper context-appropriate escaping of interpolated values and ensuring DOM-based sanitization is applied. No other mitigation is required if the upgrade is applied.