Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
An Improper Neutralization of Input During Web Page Generation issue in the site extractor component allows an attacker-controlled attribute value to be injected into output HTML without escaping. An attacker who crafts a malicious HTML page or controls content on a matching domain can execute arbitrary scripts when a victim processes the page, resulting in Cross-Site Scripting (XSS). This affects defuddle through 0.19.0 and has been patched in version 0.19.1. Impact This vulnerability allows for Cross-Site Scripting (XSS) execution without needing to compromise external websites. Affected consumers include: - Obsidian Web Clipper, - web services serving the parsed output directly as HTML, and - any downstream application rendering the unsanitized HTML results Patch This issue has been patched in defuddle version 0.19.1. Users are encouraged to update to the latest release.
Recommended action: Upgrade to 0.19.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The findContentBySchemaText method in src/defuddle.ts interpolates image src and alt attributes directly into an HTML string without escaping: An attacker can use a " in the alt attribute to break out of the attribute context and inject event handlers. This is a separate vulnerability from the sanitization bypass fixed in f154cb7 — the injection happens during string construction, not in the DOM, so stripUnsafeElements cannot catch it. Details When findContentBySchemaText finds a sibling image outside the matched content element, it reads the image's src and alt attributes via getAttribute() and interpolates them into a template literal. getAttribute('alt') returns the raw attribute value. If the alt contains ", it terminates the alt attribute in the interpolated HTML string, and subsequent content becomes new attributes (including event handlers). The recently added stripUnsafeElements() (commit f154cb7) strips on attributes from DOM elements, but the alt attribute's name is…
Recommended action: Upgrade to 0.9.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.