xhtml-purifier CVE-2026-61784

Exploitation requires that the target application (1) uses node-xhtml-purifier at a version below 0.4.3, (2) passes attacker-controlled HTML through it for sanitization, and (3) renders the purified output in a browser. The attacker must be able to inject a double-quote character into any allowed attribute value (class, style, title, alt, src, or href); the resulting breakout attaches an event handler (e.g., onmouseover, onerror). The primary limiting factor is UI:R - the victim must render and, for handlers like onmouseover, interact with (hover over) the malicious element for the script to fire; onerror-based payloads fire on load. There is no authentication requirement (PR:N), but exploitation is entirely contingent on an application actually adopting this specific niche sanitizer.

This is a genuine sanitizer bypass but a moderate-priority issue overall. The CVSS 3.1 base score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) reflects a classic stored/reflected XSS: network-reachable, low complexity, no privileges, but requiring user interaction (UI:R) and yielding only partial confidentiality/integrity impact with a scope change (the injected script executes in the victim's browser origin, a different security scope than the sanitizer library). No EPSS score, KEV listing, or SSVC decision data was provided, and no public exploit code was supplied - the diff includes only a unit test, not a weaponized PoC, so this is 'no public exploit identified at time of analysis.' The real-world risk is bounded primarily by prevalence: node-xhtml-purifier is an obscure single-maintainer npm library, so despite the CVSS being unauthenticated-network the practical blast radius is small and depends entirely on how many applications actually use this specific sanitizer to render attacker-supplied HTML. The vulnerability class (attribute-injection XSS via unencoded double-quotes) is well understood and the root cause is confirmed by the vendor advisory and the fix commit, so the technical claim is solid; the aggregate exploitation likelihood is low-to-moderate given niche deployment.

An application uses node-xhtml-purifier (<0.4.3) to sanitize user-submitted HTML (e.g., forum posts, comments, profile fields) before rendering it. An attacker submits content where an allowed attribute value contains a double-quote - for example an href or class value like c" onmouseover="alert(1) - which survives sanitization unencoded, breaks out of the quoted attribute, and injects a live event handler that executes JavaScript in the victim's browser when they view or hover over the content. No public exploit code exists, but the technique is trivial and demonstrated by the vendor's own regression test.