Description

Defuddle cleans up HTML pages. Prior to 0.19.1, site extractors interpolate page-derived image alt and src values, og:image values, and video descriptions into HTML strings without context-appropriate escaping, and buildExtractorResponse() returns this contentHtml without the main pipeline's DOM-based sanitization. The affected paths include src/extractors/x-article.ts, src/extractors/substack.ts, and src/extractors/youtube.ts. A malicious page or attacker-controlled content on a matching domain can inject event-handler attributes or javascript URLs that execute when a victim or downstream application renders the extracted HTML. This issue is fixed in version 0.19.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-08-21T21:17:01.017Z",
  "pubdate": "2026-08-21T21:17:01.017Z",
  "executiveSummary": "Defuddle prior to version 0.19.1 contains a cross-site scripting (XSS) vulnerability caused by improper output encoding and the absence of DOM-based sanitization in specific extraction response generation functions.\nThe vulnerability allows malicious pages or attacker-controlled content on matching domains to inject arbitrary script execution vectors, such as malicious event-handler attributes or javascript URLs.\nWhen a victim or downstream application renders the extracted HTML content returned by buildExtractorResponse(), the injected payloads execute within the context of the rendering application.\nThe affected components reside within specific site extractors including src/extractors/x-article.ts, src/extractors/substack.ts, and src/extractors/youtube.ts, which interpolate page-derived metadata into HTML strings without context-appropriate escaping.\nRisk implications include unauthorized script execution, session compromise, or data exfiltration when downstream consumers trust and render the un-sanitized extraction output.\nExploitation requires an attacker to supply malicious content via a matching domain or compromised page processed by the vulnerable Defuddle extractors.",
  "technicalDetails": "The root cause of the vulnerability stems from inadequate input handling and context-appropriate escaping within site extractors where page-derived attributes are directly interpolated into HTML strings.\nSpecifically, site extractors process page-derived image alt and src values, og:image values, and video descriptions without sufficient sanitization before insertion.\nThe vulnerable paths are located in src/extractors/x-article.ts, src/extractors/substack.ts, and src/extractors/youtube.ts.\nFurthermore, the buildExtractorResponse() function returns this contentHtml string directly, bypassing the main pipeline's DOM-based sanitization mechanisms that would otherwise neutralize dangerous markup.\nExploitation occurs when an attacker crafts a malicious page or injects malicious content on a matching domain containing payloads disguised as image sources, alternative text, Open Graph image tags, or video descriptions.\nWhen Defuddle processes the malicious page, the extractor interpolates the untrusted strings into the output HTML structure without encoding dangerous characters like quotes or angle brackets.\nWhen a victim or downstream consuming application subsequently renders the resulting contentHtml payload, injected event-handler attributes (such as onerror or onload) or javascript URLs execute arbitrary scripts in the victim's browser session.\nThe affected versions include all releases of Defuddle prior to version 0.19.1.\nAuthentication and privilege requirements depend on the context in which the extractor is invoked and whether the malicious content is hosted publicly or requires interaction, but the injection relies on attacker control over the source HTML processed by Defuddle."
}