Nixpkgs security tracker

Login with GitHub

Suggestions search

Published
Filter by:
With package: defuddle-cli

Found 1 matching suggestions

View:
Compact
Detailed
Permalink CVE-2026-30830
updated 2 months, 2 weeks ago by @mweinelt Activity log
  • Created suggestion 2 months, 2 weeks ago
  • @mweinelt accepted 2 months, 2 weeks ago
  • @mweinelt published on GitHub 2 months, 2 weeks ago
Defuddle: XSS via unescaped string interpolation in _findContentBySchemaText image tag

Defuddle cleans up HTML pages. Prior to version 0.9.0, the _findContentBySchemaText method in src/defuddle.ts interpolates image src and alt attributes directly into an HTML string without escaping. An attacker can use a " in the alt attribute to break out of the attribute context and inject event handler. This issue has been patched in version 0.9.0.

Affected products

defuddle
  • ==< 0.9.0

Matching in nixpkgs

pkgs.defuddle-cli

Command line utility to extract clean html, markdown and metadata from web pages

Package maintainers

Upstream advisory: https://github.com/kepano/defuddle/security/advisories/GHSA-5mq8-78gm-pjmq