defuddle vulnerable to XSS via unescaped string interpolation in _findContentBySchemaText image tag

Description

The _findContentBySchemaText method in src/defuddle.ts interpolates image src and alt attributes directly into an HTML string without escaping:

An attacker can use a " in the alt attribute to break out of the attribute context and inject event handlers.

Recommendation

Update the defuddle package to the latest compatible version. Followings are version details:

• Affected version(s): <= 0.7.0
• Patched version(s): 0.9.0

References

• GHSA-5mq8-78gm-pjmq
• CVE-2026-30830
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Nuxt OG Image is vulnerable to reflected XSS via query parameter injection into HTML attributes - CVE-2026-34405
• ExifReader is vulnerable to denial of service via unbounded decompression of image metadata - CVE-2026-8814
• CleverTap Web SDK is vulnerable to DOM-based XSS via handleCustomHtmlPreviewPostMessageEvent function - CVE-2026-26861
• CleverTap Web SDK is vulnerable to DOM-based Cross-Site Scripting (XSS) via window.postMessage - CVE-2026-26862

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

Tags:

npm

defuddle