CVE-2026-61784: xhtml-purifier has HTML attribute-injection (sanitizer bypass) that leads to XSS
xhtml-purifier does not HTML-entity-encode attribute values when serializing its sanitized output. In attributeString() (XHTMLPurifier.js, around line 148) the attribute value is concatenated directly into a double-quoted attribute without encoding. As a result, an attacker-controlled value in any allowed attribute (class, style, title, alt, src, href) can include a double-quote character to break out of the attribute and inject an additional attribute, such as a JavaScript event handler (for example onmouseover or onerror). The injected handler survives sanitization and executes when the output is rendered, which is a sanitizer bypass leading to cross-site scripting. The fix HTML-entity-encodes attribute values before serialization.
Other sources
xhtml-purifier is a Node.js library to take in raw/unknown/untrusted HTML and output cleaned, purified, trusted HTML. Versions prior to 0.4.3 do not HTML-entity-encode attribute values when serializing its sanitized output. In attributeString() (XHTMLPurifier.js, around line 148) the attribute value is concatenated directly into a double-quoted attribute without encoding. As a result, an attacker-controlled value in any allowed attribute (class, style, title, alt, src, href) can include a double-quote character to break out of the attribute and inject an additional attribute, such as a JavaScript event handler (for example onmouseover or onerror). The injected handler survives sanitization and executes when the output is rendered, which is a sanitizer bypass leading to cross-site scripting. The fix in version 0.4.3 HTML-entity-encodes attribute values before serialization.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/xhtml-purifierto a version that resolves this vulnerability.Fixed in 0.4.3 - Upgrade
Upgrade
xhtml-purifierto a version that resolves this vulnerability.Fixed in 0.4.3
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Applications using npm/xhtml-purifier versions earlier than 0.4.3 to sanitize untrusted HTML are exposed if they render the sanitizer's output. The affected attributes include allowed attributes such as class, style, title, alt, src, and href.
What does an attacker need to exploit the flaw?
An attacker needs a way to supply HTML that is processed by the vulnerable sanitizer and later rendered in a browser. They can place a double quote in an allowed attribute value to escape the serialized attribute and add an event-handler attribute, such as onmouseover or onerror; execution also requires the relevant user interaction or error condition.
What should be done if an immediate upgrade is not possible?
The provided data identifies version 0.4.3 as the fix, which HTML-entity-encodes attribute values before serialization. No alternative mitigation is specified.
How can teams determine whether they are affected?
Check whether the application depends on npm/xhtml-purifier at a version earlier than 0.4.3 and uses it on attacker-controlled HTML. Review whether its sanitized output is rendered, since rendering is what enables the injected event handler to execute.