CVE-2026-61824

Defuddle cleans up HTML pages. Prior to 0.19.1, site extractors interpolate page-derived image alt and src values, og:image values, and video descriptions into HTML strings without context-appropriate escaping, and buildExtractorResponse() returns this contentHtml without the main pipeline's DOM-based sanitization. The affected paths include src/extractors/x-article.ts, src/extractors/substack.ts, and src/extractors/youtube.ts. A malicious page or attacker-controlled content on a matching domain can inject event-handler attributes or javascript URLs that execute when a victim or downstream application renders the extracted HTML. This issue is fixed in version 0.19.1.

• CWE-79
• CWE-116

• https://github.com/kepano/defuddle/commit/baf2eaef61d334ef595b28c89e5c5e89e52daf7f
• https://github.com/kepano/defuddle/pull/326
• https://github.com/kepano/defuddle/releases/tag/0.19.1
• https://github.com/kepano/defuddle/security/advisories/GHSA-jg4p-g6xj-4qmf

Published

Aug 21, 2026

Last Modified

Aug 24, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-61800Wazuh is an open-source security platform providing unified …9.1
• CVE-2026-61802Wazuh is an open-source security platform providing unified …6.5
• CVE-2026-61807Snipe-IT is an IT asset/license management system. Prior to …6.3
• CVE-2026-61808LightRAG provides simple and fast retrieval-augmented genera…9.8
• CVE-2026-6181The Device Configuration Framework is vulnerable to an authe…5.9
• CVE-2026-6182A vulnerability was identified in code-projects Simple Conte…7.3
• CVE-2026-61828Nixpkgs is a collection of software packages that can be ins…8.5
• CVE-2026-61829Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-6183A security flaw has been discovered in code-projects Simple …7.3
• CVE-2026-61835Directus is a real-time API and App dashboard for managing S…7.7
• CVE-2026-61836Directus is a real-time API and App dashboard for managing S…8.6
• CVE-2026-61839Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…