Executive brief
xhtml-purifier is a JavaScript library used to sanitize HTML content and remove potentially dangerous code. The library fails to properly encode attribute values when processing sanitized output, allowing attackers to inject malicious JavaScript code that executes in a user's browser. This sanitizer bypass defeats the library's core security purpose and can lead to account compromise, data theft, or malware distribution.
Technical details
The vulnerability is an improper output encoding flaw (CWE-116/CWE-79) in the attributeString() function of XHTMLPurifier.js (line ~148). Attribute values are concatenated directly into double-quoted attributes without HTML-entity encoding, allowing an attacker to include a double-quote character to break out of the attribute context and inject additional attributes such as JavaScript event handlers (onmouseover, onerror). The injected handler bypasses the sanitizer and executes when the output is rendered in a browser. Attack vector is network-based with user interaction required (rendering the page); no authentication is needed. The fix HTML-entity-encodes all attribute values before serialization. Patched in version 0.4.3.
Affected products
- cstigler xhtml-purifier <= 0.4.1
Timeline
- 2026-06-24: disclosed
- 2026-09-24: advisory
- 2026-09-24: patched: Version 0.4.3 released