https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 20:58:45 +0000 https://cve.radiocsirt.org/vuln/brew-defuddle-cve-2026-61824 <p><strong>Affected:</strong> Homebrew: defuddle</p> <p>## Summary</p> <p>An Improper Neutralization of Input During Web Page Generation issue in the site extractor component allows an attacker-controlled attribute value to be injected into output HTML without escaping. An attacker who crafts a malicious HTML page or controls content on a matching domain can execute arbitrary scripts when a victim processes the page, resulting in Cross-Site Scripting (XSS). This affects defuddle through 0.19.0 and has been patched in version 0.19.1.</p> <p>## Impact</p> <p>This vulnerability allows for Cross-Site Scripting (XSS) execution without needing to compromise external websites. Affected consumers include: - Obsidian Web Clipper, - web services serving the parsed output directly as HTML, and - any downstream application rendering the unsanitized HTML results</p> <p>## Patch This issue has been patched in defuddle version 0.19.1. Users are encouraged to update to the latest release.</p> <p><strong>Affected:</strong> Homebrew: defuddle</p> <p>## Summary</p> <p>An Improper Neutralization of Input During Web Page Generation issue in the site extractor component allows an attacker-controlled attribute value to be injected into output HTML without escaping. An attacker who crafts a malicious HTML page or controls content on a matching domain can execute arbitrary scripts when a victim processes the page, resulting in Cross-Site Scripting (XSS). This affects defuddle through 0.19.0 and has been patched in version 0.19.1.</p> <p>## Impact</p> <p>This vulnerability allows for Cross-Site Scripting (XSS) execution without needing to compromise external websites. Affected consumers include: - Obsidian Web Clipper, - web services serving the parsed output directly as HTML, and - any downstream application rendering the unsanitized HTML results</p> <p>## Patch This issue has been patched in defuddle version 0.19.1. Users are encouraged to update to the latest release.</p> https://cve.radiocsirt.org/vuln/brew-defuddle-cve-2026-61824 https://cve.radiocsirt.org/vuln/euvd-2026-358327 EUVD-2026-358327 https://cve.radiocsirt.org/vuln/euvd-2026-358327 https://cve.radiocsirt.org/vuln/fkie_cve-2026-61824 <p>Defuddle cleans up HTML pages. Prior to 0.19.1, site extractors interpolate page-derived image alt and src values, og:image values, and video descriptions into HTML strings without context-appropriate escaping, and buildExtractorResponse() returns this contentHtml without the main pipeline&#39;s DOM-based sanitization. The affected paths include src/extractors/x-article.ts, src/extractors/substack.ts, and src/extractors/youtube.ts. A malicious page or attacker-controlled content on a matching domain can inject event-handler attributes or javascript URLs that execute when a victim or downstream application renders the extracted HTML. This issue is fixed in version 0.19.1.</p> <p>Defuddle cleans up HTML pages. Prior to 0.19.1, site extractors interpolate page-derived image alt and src values, og:image values, and video descriptions into HTML strings without context-appropriate escaping, and buildExtractorResponse() returns this contentHtml without the main pipeline&#39;s DOM-based sanitization. The affected paths include src/extractors/x-article.ts, src/extractors/substack.ts, and src/extractors/youtube.ts. A malicious page or attacker-controlled content on a matching domain can inject event-handler attributes or javascript URLs that execute when a victim or downstream application renders the extracted HTML. This issue is fixed in version 0.19.1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-61824 https://cve.radiocsirt.org/vuln/ghsa-jg4p-g6xj-4qmf <p><strong>Affected:</strong> npm: defuddle</p> <p>## Summary</p> <p>An Improper Neutralization of Input During Web Page Generation issue in the site extractor component allows an attacker-controlled attribute value to be injected into output HTML without escaping. An attacker who crafts a malicious HTML page or controls content on a matching domain can execute arbitrary scripts when a victim processes the page, resulting in Cross-Site Scripting (XSS). This affects defuddle through 0.19.0 and has been patched in version 0.19.1.</p> <p>## Impact</p> <p>This vulnerability allows for Cross-Site Scripting (XSS) execution without needing to compromise external websites. Affected consumers include: - Obsidian Web Clipper, - web services serving the parsed output directly as HTML, and - any downstream application rendering the unsanitized HTML results</p> <p>## Patch This issue has been patched in defuddle version 0.19.1. Users are encouraged to update to the latest release.</p> <p><strong>Affected:</strong> npm: defuddle</p> <p>## Summary</p> <p>An Improper Neutralization of Input During Web Page Generation issue in the site extractor component allows an attacker-controlled attribute value to be injected into output HTML without escaping. An attacker who crafts a malicious HTML page or controls content on a matching domain can execute arbitrary scripts when a victim processes the page, resulting in Cross-Site Scripting (XSS). This affects defuddle through 0.19.0 and has been patched in version 0.19.1.</p> <p>## Impact</p> <p>This vulnerability allows for Cross-Site Scripting (XSS) execution without needing to compromise external websites. Affected consumers include: - Obsidian Web Clipper, - web services serving the parsed output directly as HTML, and - any downstream application rendering the unsanitized HTML results</p> <p>## Patch This issue has been patched in defuddle version 0.19.1. Users are encouraged to update to the latest release.</p> https://cve.radiocsirt.org/vuln/ghsa-jg4p-g6xj-4qmf