GHSA-j8r4-32c5-33rc: XSS

Q: What conditions are required to exploit this issue?

An attacker needs to control a value placed into an attribute that xhtml-purifier allows, such as class, style, title, alt, src, or href. The malicious value must contain a double quote to escape the serialized attribute and add an event-handler attribute; execution then requires the sanitized output to be rendered and the relevant browser event to occur.

Q: Is user interaction required?

Yes. The advisory’s vector includes UI:R, and the described payload executes through an injected event handler such as onmouseover or onerror. The exact interaction depends on the injected handler and how the rendered content is used.

Q: What is the practical impact of successful exploitation?

This is a sanitizer bypass that enables cross-site scripting in the context where the sanitized HTML is rendered. An attacker can inject an additional attribute, including a JavaScript event handler, despite the original attribute being allowed by the sanitizer.

Published Sep 24, 2026

Updated

xhtml-purifier does not HTML-entity-encode attribute values when serializing its sanitized output. In attributeString() (XHTMLPurifier.js, around line 148) the attribute value is concatenated directly into a double-quoted attribute without encoding. As a result, an attacker-controlled value in any allowed attribute (class, style, title, alt, src, href) can include a double-quote character to break out of the attribute and inject an additional attribute, such as a JavaScript event handler (for example onmouseover or onerror). The injected handler survives sanitization and executes when the output is rendered, which is a sanitizer bypass leading to cross-site scripting. The fix HTML-entity-encodes attribute values before serialization.

Affected Software

1 affected componentFixes available

npm/xhtml-purifier<=0.4.1

0.4.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade npm/xhtml-purifier to a version that resolves this vulnerability.
Fixed in 0.4.3

Event History

Sep 24, 2026

Advisory Published

via GitHub·07:33 PM

Data Sourced

via GitHub·07:33 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What conditions are required to exploit this issue?

An attacker needs to control a value placed into an attribute that xhtml-purifier allows, such as class, style, title, alt, src, or href. The malicious value must contain a double quote to escape the serialized attribute and add an event-handler attribute; execution then requires the sanitized output to be rendered and the relevant browser event to occur.

Is user interaction required?

Yes. The advisory’s vector includes UI:R, and the described payload executes through an injected event handler such as onmouseover or onerror. The exact interaction depends on the injected handler and how the rendered content is used.

What is the practical impact of successful exploitation?

This is a sanitizer bypass that enables cross-site scripting in the context where the sanitized HTML is rendered. An attacker can inject an additional attribute, including a JavaScript event handler, despite the original attribute being allowed by the sanitizer.

What change addresses the vulnerability?

The fix HTML-entity-encodes attribute values before serializing sanitized output. This prevents attacker-controlled double quotes from terminating the surrounding double-quoted attribute and injecting a new one.