Description
The _findContentBySchemaText method in src/defuddle.ts interpolates image src and alt attributes directly into an HTML string without escaping:
An attacker can use a " in the alt attribute to break out of the attribute context and inject event handlers.
Recommendation
Update the defuddle package to the latest compatible version. Followings are version details:
- Affected version(s): <= 0.7.0
- Patched version(s): 0.9.0
References
Could your website be exposed too?
SmartScanner can check your website for defuddle vulnerable to XSS via unescaped string interpolation in _findContentBySchemaText image tag and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Nuxt OG Image is vulnerable to reflected XSS via query parameter injection into HTML attributes - CVE-2026-34405
- ExifReader is vulnerable to denial of service via unbounded decompression of image metadata - CVE-2026-8814
- CleverTap Web SDK is vulnerable to DOM-based XSS via handleCustomHtmlPreviewPostMessageEvent function - CVE-2026-26861
- CleverTap Web SDK is vulnerable to DOM-based Cross-Site Scripting (XSS) via window.postMessage - CVE-2026-26862
You might also like:
See something that needs correcting? Let us knowUpdated July 20, 2026