Defuddle
Monthly
Cross-site scripting in Defuddle prior to 0.19.1 allows an attacker who controls content on a domain handled by a site extractor (X/Twitter, Substack, YouTube) to inject event-handler attributes or javascript: URLs into extracted HTML output. Three site extractors interpolate page-derived values - image alt/src attributes, og:image metadata, and video descriptions - into template literals without HTML escaping, and the resulting HTML is returned by buildExtractorResponse() without passing through the main pipeline's DOM-based sanitization. A vendor-released patch is available in version 0.19.1; no public exploit has been identified at time of analysis.
Defuddle versions prior to 0.9.0 fail to properly escape image attributes in HTML processing, allowing attackers to inject malicious event handlers through specially crafted alt text containing quote characters. Public exploit code exists for this cross-site scripting vulnerability. The vulnerability affects all users of Defuddle before version 0.9.0, and a patch is available.
Cross-site scripting in Defuddle prior to 0.19.1 allows an attacker who controls content on a domain handled by a site extractor (X/Twitter, Substack, YouTube) to inject event-handler attributes or javascript: URLs into extracted HTML output. Three site extractors interpolate page-derived values - image alt/src attributes, og:image metadata, and video descriptions - into template literals without HTML escaping, and the resulting HTML is returned by buildExtractorResponse() without passing through the main pipeline's DOM-based sanitization. A vendor-released patch is available in version 0.19.1; no public exploit has been identified at time of analysis.
Defuddle versions prior to 0.9.0 fail to properly escape image attributes in HTML processing, allowing attackers to inject malicious event handlers through specially crafted alt text containing quote characters. Public exploit code exists for this cross-site scripting vulnerability. The vulnerability affects all users of Defuddle before version 0.9.0, and a patch is available.