HTML Injection Vulnerability in Defuddle by Kepano
CVE-2026-30830

2.1LOW

Key Information:

Vendor

Kepano

Status
Defuddle
Vendor
CVE Published:
7 March 2026

What is CVE-2026-30830?

An HTML injection vulnerability exists in the Defuddle application prior to version 0.9.0. The issue lies within the _findContentBySchemaText method in the src/defuddle.ts file, which directly interpolates the image src and alt attributes into an HTML string without proper escaping. This lack of escaping allows an attacker to manipulate the alt attribute, injecting malicious JavaScript through event handlers. This vulnerability poses a significant risk for users of the affected versions, as it can be exploited to execute arbitrary scripts in the context of the web page. The vulnerability has been resolved in version 0.9.0.

Affected Version(s)

defuddle < 0.9.0

References

https://github.com/kepano/defuddle/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/kepano/defuddle/commit/f154cb740ee6034...
x_refsource_MISC

CVSS V4

Score:
2.1
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.