Executive brief
Defuddle, a library used for extracting content from web pages, is vulnerable to a security flaw that could allow an attacker to execute malicious scripts in a user's browser. This occurs when the library processes specially crafted web content containing images with malicious descriptions. If an application like a browser extension or reader mode uses this library to display content, an attacker could potentially steal user data or perform actions on the user's behalf.
Technical details
A Cross-Site Scripting (XSS) vulnerability exists in defuddle's `_findContentBySchemaText` method within `src/defuddle.ts`. The vulnerability is caused by direct string interpolation of `src` and `alt` attributes into an HTML string without proper escaping. An attacker can provide a crafted HTML document with schema.org metadata and an image containing a double-quote character in its `alt` attribute to break out of the attribute context and inject malicious event handlers (e.g., `onload`). This bypasses existing DOM-based sanitization because the injection occurs during string construction before the content is parsed into the DOM. The issue is fixed in version 0.9.0 by using the DOM API for element creation instead of template literals.
Affected products
- kepano defuddle <= 0.7.0
Timeline
- 2026-03-05: disclosed
- 2026-03-06: advisory: GitHub Advisory published
- 2026-03-07: other: NVD published