XHTML Purifier Library Node.js Vulnerability Leading to Cross-Site Scripting
CVE-2026-61784

6.1MEDIUM

Key Information:

Vendor

Cstigler

Status
Node-xhtml-purifier
Vendor
CVE Published:
24 September 2026

What is CVE-2026-61784?

The XHTML Purifier library, used for cleaning raw HTML input, has a vulnerability in versions prior to 0.4.3 that allows attackers to inject arbitrary attributes into sanitized output. Specifically, the library fails to HTML-entity-encode attribute values when serializing, which can enable the insertion of JavaScript event handlers through attributes like class, style, or href. This bypass of the sanitizer can lead to cross-site scripting attacks, allowing malicious scripts to execute in a user's browser when rendered. The issue is resolved in version 0.4.3 where proper encoding measures were implemented.

Affected Version(s)

node-xhtml-purifier < 0.4.3

References

https://github.com/cstigler/node-xhtml-purifier/security/...
x_refsource_CONFIRM
https://github.com/cstigler/node-xhtml-purifier/commit/21...
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.