Defuddle cleans up HTML pages. Prior to version 0.9.0, the _findContentBySchemaText method in src/defuddle.ts interpolates image src and alt attributes directly into an HTML string without escaping. An attacker can use a " in the alt attribute to break out of the attribute context and inject event handler. This issue has been patched in version 0.9.0.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
| Source | ID | Title |
|---|---|---|
 Github GHSA |
GHSA-5mq8-78gm-pjmq | defuddle vulnerable to XSS via unescaped string interpolation in _findContentBySchemaText image tag |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Sat, 07 Mar 2026 06:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Defuddle cleans up HTML pages. Prior to version 0.9.0, the _findContentBySchemaText method in src/defuddle.ts interpolates image src and alt attributes directly into an HTML string without escaping. An attacker can use a " in the alt attribute to break out of the attribute context and inject event handler. This issue has been patched in version 0.9.0. | |
| Title | Defuddle: XSS via unescaped string interpolation in _findContentBySchemaText image tag | |
| Weaknesses | CWE-79 | |
| References |
| |
| Metrics |
cvssV4_0
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2026-03-07T05:49:15.964Z
Reserved: 2026-03-05T21:06:44.606Z
Link: CVE-2026-30830
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-03-07T06:16:11.163
Modified: 2026-03-07T06:16:11.163
Link: CVE-2026-30830
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses