Executive brief
Defuddle is a library used to extract and parse content from web pages, widely relied upon by tools like Obsidian Web Clipper. An unescaped attribute injection vulnerability allows attackers to inject malicious scripts into HTML output without escaping, enabling cross-site scripting (XSS) attacks. When a user processes a crafted malicious page, arbitrary JavaScript can execute in their browser, potentially stealing credentials or session data.
Technical details
The vulnerability is a classic XSS flaw (CWE-79, CWE-116) in the site extractor component, where attribute values from HTML input are interpolated into output HTML without proper escaping. An attacker can craft a malicious HTML page or control content on a domain matching the extraction rules to inject attacker-controlled attribute values. The vulnerability requires user interaction (the victim must process the malicious page) but has no privilege or authentication requirements. The attack affects the confidentiality and integrity of data processed by downstream applications that render the unsanitized HTML, particularly Obsidian Web Clipper and web services serving the parsed output directly. Patch version 0.19.1 addresses this issue and is available for immediate update.
Affected products
- kepano defuddle 0.19.0 and earlier
Timeline
- 2026-06-24: disclosed: Published in GitHub Advisory Database
- 2026-06-24: patched: Patched in version 0.19.1
- 2026-08-21: advisory: Updated advisory publication date