EUVD-2026-64132
GHSA-jg4p-g6xj-4qmf
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
Attacker controls source page content requiring no privileges (PR:N); victim must actively invoke extraction (UI:R); injected JS executes in downstream application context (S:C); high confidentiality from potential session theft.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4Blast Radius
ecosystem impact- 6 npm packages depend on defuddle (5 direct, 1 indirect)
Ecosystem-wide dependent count for version 0.19.1.
DescriptionCVE.org
Defuddle cleans up HTML pages. Prior to 0.19.1, site extractors interpolate page-derived image alt and src values, og:image values, and video descriptions into HTML strings without context-appropriate escaping, and buildExtractorResponse() returns this contentHtml without the main pipeline's DOM-based sanitization. The affected paths include src/extractors/x-article.ts, src/extractors/substack.ts, and src/extractors/youtube.ts. A malicious page or attacker-controlled content on a matching domain can inject event-handler attributes or javascript URLs that execute when a victim or downstream application renders the extracted HTML. This issue is fixed in version 0.19.1.
AnalysisAI
Cross-site scripting in Defuddle prior to 0.19.1 allows an attacker who controls content on a domain handled by a site extractor (X/Twitter, Substack, YouTube) to inject event-handler attributes or javascript: URLs into extracted HTML output. Three site extractors interpolate page-derived values - image alt/src attributes, og:image metadata, and video descriptions - into template literals without HTML escaping, and the resulting HTML is returned by buildExtractorResponse() without passing through the main pipeline's DOM-based sanitization. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent conditions: the victim application must use Defuddle prior to version 0.19.1 and invoke one of the three affected extractors (x-article.ts for X/Twitter, substack.ts for Substack, youtube.ts for YouTube); the attacker must control content on a domain that triggers the relevant extractor, either by publishing content on X.com, Substack, or YouTube directly; and the extracted HTML must be rendered in a browser, Electron webview, or other JavaScript-executing HTML context. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.2 score reflects a network-accessible, low-complexity XSS with scope change and high confidentiality impact - consistent with stored XSS that executes in a downstream rendering context. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Defuddle to version 0.19.1 or later; the tagged release is available at https://github.com/kepano/defuddle/releases/tag/0.19.1, and the fixing commit is baf2eaef61d334ef595b28c89e5c5e89e52daf7f (pull request #326). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, immediately upgrade all Defuddle instances to version 0.19.1 to apply the vendor-released patch, or as an interim measure, disable the Twitter/X, Substack, and YouTube site extractors. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today