Description
An Improper Neutralization of Input During Web Page Generation issue in the site extractor component allows an attacker-controlled attribute value to be injected into output HTML without escaping.
Recommendation
Update the defuddle package to the latest compatible version. Followings are version details:
- Affected version(s): <= 0.19.0
- Patched version(s): 0.19.1
References
Could your website be exposed too?
SmartScanner can check your website for Defuddle vulnerable to XSS via unescaped attribute interpolation in site extractors and gives you actionable findings to investigate.
Start a free scanRelated Issues
- defuddle vulnerable to XSS via unescaped string interpolation in _findContentBySchemaText image tag - CVE-2026-30830
- Etherpad has stored XSS in HTML export via unescaped attribute-pool values - CVE-2026-55090
- Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script> in serialized function bodies - CVE-2026-97711
- Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body - CVE-2026-115897
You might also like:
See something that needs correcting? Let us knowUpdated August 21, 2026