27 matches found
defuddle 跨站脚本漏洞
Defuddle is a web content extraction and cleaning tool developed by Steph Ango. Versions of Defuddle prior to 0.9.0 contained a cross-site scripting vulnerability. This vulnerability arose from the findContentBySchemaText method, which directly inserted image src and alt attributes into HTML...
CVE-2026-30830: Improper Neutralization of Input During Web Page Generation
Defuddle cleans up HTML pages. Prior to version 0.9.0, the findContentBySchemaText method in src/defuddle.ts interpolates image src and alt attributes directly into an HTML string without escaping. An attacker can use a " in the alt attribute to break out of the attribute context and inject event...
GHSA-5MQ8-78GM-PJMQ defuddle vulnerable to XSS via unescaped string interpolation in _findContentBySchemaText image tag
Summary The findContentBySchemaText method in src/defuddle.ts interpolates image src and alt attributes directly into an HTML string without escaping: typescript html += ; An attacker can use a " in the alt attribute to break out of the attribute context and inject event handlers. This is a...
@agent-infra/browser-context (>=0.1.2, <=0.2.2), @agent-infra/mcp-server-browser (>=1.2.15, <=1.2.29) +21 more potentially affected by CVE-2026-30830 via defuddle (>=0.3.8, <=0.8.0)
defuddle NPM version =0.3.8, =0.1.2, =1.2.15, =0.0.1, =1.0.4, =1.4.0, =0.1.0, =0.1.0, =0.12.0, =0.12.0, =0.3.0, =0.7.1 - @vibe-reader/cli 0.1.0 - browser-automation-mcp 1.0.1 and more Source cves: CVE-2026-30830 Source advisory: SNYK:JS-DEFUDDLE-15441037...
@agent-infra/browser-context (>=0.1.2, <=0.2.2), @agent-infra/mcp-server-browser (>=1.2.15, <=1.2.29) +21 more potentially affected by CVE-2026-30830 via defuddle (>=0.3.8, <=0.8.0)
defuddle NPM version =0.3.8, =0.1.2, =1.2.15, =0.0.1, =1.0.4, =1.4.0, =0.1.0, =0.1.0, =0.12.0, =0.12.0, =0.3.0, =0.7.1 - @vibe-reader/cli 0.1.0 - browser-automation-mcp 1.0.1 and more Source cves: CVE-2026-30830 Source advisory: OSV:GHSA-5MQ8-78GM-PJMQ...
Cross-site Scripting (XSS)
Overview defuddle is an Extract article content and metadata from web pages. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the findContentBySchemaText fallback in src/defuddle.ts. An attacker can execute arbitrary scripts in consuming applications extensions,...
