Kepano

kepano

1 CVE • 1 product

Products (1)

Click to collapse

Toggle

Defuddle

defuddle

1 CVE

CVEs (1)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2026-30830 1Kepano 1Defuddle Jun 17, 2026 Mar 7, 2026 2.1 LOW· v4 6.1 MEDIUM· v3 N/A· v2 Defuddle cleans up HTML pages. Prior to version 0.9.0, the _findContentBySchemaText method in src/defuddle.ts interpolates image src and alt attributes directly into an HTML string without escaping. An attacker can use a...Show more Defuddle cleans up HTML pages. Prior to version 0.9.0, the _findContentBySchemaText method in src/defuddle.ts interpolates image src and alt attributes directly into an HTML string without escaping. An attacker can use a " in the alt attribute to break out of the attribute context and inject event handler. This issue has been patched in version 0.9.0.Show less

CVE

VENDORS

PRODUCTS

UPDATED

PUBLISHED

CVSS

CVE-2026-30830

1Kepano

1Defuddle

Jun 17, 2026

Mar 7, 2026

2.1 LOW· v4

6.1 MEDIUM· v3

N/A· v2

Defuddle cleans up HTML pages. Prior to version 0.9.0, the _findContentBySchemaText method in src/defuddle.ts interpolates image src and alt attributes directly into an HTML string without escaping. An attacker can use a " in the alt attribute to break out of the attribute context and inject event handler. This issue has been patched in version 0.9.0.Show less