GHSA-jg4p-g6xj-4qmf: XSS

Q: Which deployments are most exposed to this issue?

Consumers that render defuddle's parsed output as HTML are affected, including Obsidian Web Clipper, web services serving parsed output directly, and downstream applications that render unsanitized results. The issue can be triggered without compromising an external website.

Q: What must an attacker do to exploit it?

The attacker must provide a malicious HTML page or control content on a matching domain, with an attacker-controlled attribute value that reaches the site extractor output. A victim must then process the page, at which point arbitrary script can execute.

Q: What is the remediation?

Upgrade defuddle to version 0.19.1 or later. Versions through 0.19.0 are affected.

Published Aug 21, 2026

Updated

Summary

An Improper Neutralization of Input During Web Page Generation issue in the site extractor component allows an attacker-controlled attribute value to be injected into output HTML without escaping. An attacker who crafts a malicious HTML page or controls content on a matching domain can execute arbitrary scripts when a victim processes the page, resulting in Cross-Site Scripting (XSS). This affects defuddle through 0.19.0 and has been patched in version 0.19.1.

Impact

This vulnerability allows for Cross-Site Scripting (XSS) execution without needing to compromise external websites. Affected consumers include: - Obsidian Web Clipper, - web services serving the parsed output directly as HTML, and - any downstream application rendering the unsanitized HTML results

Patch This issue has been patched in defuddle version 0.19.1. Users are encouraged to update to the latest release.

Affected Software

1 affected componentFixes available

npm/defuddle<=0.19.0

0.19.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade npm/defuddle to a version that resolves this vulnerability.
Fixed in 0.19.1
Upgrade
Upgrade defuddle to a version that resolves this vulnerability.
Fixed in 0.19.1
Operational
Update any downstream application rendering the extracted/parsed HTML output so it uses the patched defuddle version 0.19.1.

Event History

Aug 21, 2026

Advisory Published

via GitHub·08:54 PM

Data Sourced

via GitHub·08:54 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Which deployments are most exposed to this issue?

Consumers that render defuddle's parsed output as HTML are affected, including Obsidian Web Clipper, web services serving parsed output directly, and downstream applications that render unsanitized results. The issue can be triggered without compromising an external website.

What must an attacker do to exploit it?