EUVD-2026-64132

Defuddle cleans up HTML pages. Prior to 0.19.1, site extractors interpolate page-derived image alt and src values, og:image values, and video descriptions into HTML strings without context-appropriate escaping, and buildExtractorResponse returns this contentHtml without the main pipeline's...

CVE-2026-61824

Defuddle (an HTML page cleaner) is vulnerable to cross-site scripting (XSS) prior to version 0.19.1 . Site extractors interpolate page-derived values—image alt/src attributes, og:image values, and video descriptions—into HTML strings without context-appropriate escaping. Additionally, buildExtrac...