{"uuid": "567e9dca-6fec-4a1f-b28e-dc7adc4f45f6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-j8r4-32c5-33rc", "type": "seen", "source": "https://gist.github.com/alon710/f611d72b281b196826650e03968e5bde", "content": "# CVE-2026-61784: CVE-2026-61784: HTML Attribute Injection and Sanitizer Bypass in node-xhtml-purifier\n\n> **CVSS Score:** 6.1\n> **Published:** 2026-09-24\n> **Full Report:** https://cvereports.com/reports/CVE-2026-61784\n\n## Summary\nA critical sanitizer bypass vulnerability exists in the xhtml-purifier Node.js library prior to version 0.4.3. Due to a lack of HTML entity encoding during the attribute re-serialization phase, unauthenticated remote attackers can break out of double-quoted attribute contexts to inject arbitrary script handlers, resulting in Cross-Site Scripting.\n\n## TL;DR\nThe xhtml-purifier library does not encode double quotes in attribute values during re-serialization, allowing attackers to inject malicious HTML attributes like event handlers and execute arbitrary JavaScript.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-79\n- **Attack Vector**: Network\n- **CVSS Score**: 6.1 (Medium)\n- **EPSS Score**: 0.00168\n- **Impact**: Sanitizer Bypass / Cross-Site Scripting (XSS)\n- **Exploit Status**: PoC / Functional Tests available\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Applications utilizing the Node.js package 'xhtml-purifier' for HTML sanitization in versions prior to 0.4.3.\n- **xhtml-purifier**: < 0.4.3 (Fixed in: `0.4.3`)\n\n## Mitigation\n\n- Upgrade the xhtml-purifier dependency to version 0.4.3 or higher.\n- Configure WAF rules to intercept and block inputs containing HTML attribute breakouts and event handlers.\n- Implement strong Content Security Policies (CSP) to restrict inline script execution and limit XSS impact.\n\n**Remediation Steps:**\n1. Run `npm audit` in the application root directory to identify vulnerable instances of `xhtml-purifier`.\n2. Update your dependencies in `package.json` to require `xhtml-purifier` version `^0.4.3`.\n3. Execute `npm install` to retrieve and apply the patched package versions.\n4. Run regression and security tests with test payloads containing double-quotes within HTML tags to confirm escaping functionality.\n\n## References\n\n- [Fix Commit (GitHub)](https://github.com/cstigler/node-xhtml-purifier/commit/21d461ad23e7bc9b3073693d5b51b9b8662044d3)\n- [GitHub Security Advisory (GHSA)](https://github.com/cstigler/node-xhtml-purifier/security/advisories/GHSA-j8r4-32c5-33rc)\n- [NVD Entry](https://nvd.nist.gov/vuln/detail/CVE-2026-61784)\n- [CVE Record (CVE.org)](https://www.cve.org/CVERecord?id=CVE-2026-61784)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-61784) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-25T15:30:32.000000Z"}