Vulnerability · Published Sep 24, 2026 · Assigned by GitHub_M
CVE-2026-61784xhtml-purifier has HTML attribute-injection (sanitizer bypass) that leads to XSS
Medium 6.1
In plain English
A medium-severity cross-site scripting in node-xhtml-purifier from cstigler. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
xhtml-purifier is a Node.js library to take in raw/unknown/untrusted HTML and output cleaned, purified, trusted HTML. Versions prior to 0.4.3 do not HTML-entity-encode attribute values when serializing its sanitized output. In attributeString() (XHTMLPurifier.js, around line 148) the attribute value is concatenated directly into a double-quoted attribute without encoding. As a result, an attacker-controlled value in any allowed attribute (class, style, title, alt, src, href) can include a double-quote character to break out of the attribute and inject an additional attribute, such as a JavaScript event handler (for example onmouseover or onerror). The injected handler survives sanitization and executes when the output is rendered, which is a sanitizer bypass leading to cross-site scripting. The fix in version 0.4.3 HTML-entity-encodes attribute values before serialization.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | xhtml-purifier | 0.4.3 | GHSA-j8r4-32c5-33rc |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| cstigler | node-xhtml-purifier | < 0.4.3 |
Weakness: CWE-79, CWE-116 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N