Description
The _findContentBySchemaText method in src/defuddle.ts interpolates image src and alt attributes directly into an HTML string without escaping:
An attacker can use a " in the alt attribute to break out of the attribute context and inject event handlers.
Recommendation
Update the defuddle package to the latest compatible version. Followings are version details:
- Affected version(s): <= 0.7.0
- Patched version(s): 0.9.0
References
Could your website be exposed too?
SmartScanner can check your website for defuddle vulnerable to XSS via unescaped string interpolation in _findContentBySchemaText image tag and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Defuddle vulnerable to XSS via unescaped attribute interpolation in site extractors - CVE-2026-61824
- Nuxt OG Image is vulnerable to reflected XSS via query parameter injection into HTML attributes - CVE-2026-34405
- Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead() - CVE-2026-106102
- open-webui Vulnerable to Stored XSS via Model Description - CVE-2026-44721
You might also like:
See something that needs correcting? Let us knowUpdated July 20, 2026