CVE-2026-30830CWE-79

Defuddle: XSS via unescaped string interpolation in _findContentBySchemaText image tag

Low · published March 7, 2026

CVSS v4.0
2.1
EPSS
0%
Percentile
19.6
In the wild
Unconfirmed
What it is

Defuddle cleans up HTML pages. Prior to version 0.9.0, the _findContentBySchemaText method in src/defuddle.ts interpolates image src and alt attributes directly into an HTML string without escaping. An attacker can use a " in the alt attribute to break out of the attribute context and inject event handler. This issue has been patched in version 0.9.0.

The record
Technical detail
CVSS v4.0
2.1 · LOW
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P
EPSS
0.00282 · 19.6th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-03-07T05:49Z
EPSS history
Timeline
  • 07 MAR 05:49Z
    Defuddle: XSS via unescaped string interpolation in _findContentBySchemaText image tag
    cvelistv5