CVE-2026-61784 xhtml-purifier has HTML attribute-injection (sanitizer bypass) that leads to XSS
Attackers can inject JavaScript via unencoded attribute values in xhtml-purifier, bypassing sanitization to execute scripts in victim browsers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-61784?
CVE-2026-61784 is a medium-severity cross-site scripting vulnerability in cstigler node-xhtml-purifier, published on 24 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
xhtml-purifier is a Node.js library to take in raw/unknown/untrusted HTML and output cleaned, purified, trusted HTML. Versions prior to 0.4.3 do not HTML-entity-encode attribute values when serializing its sanitized output. In attributeString() (XHTMLPurifier.js, around line 148) the attribute value is concatenated directly into a double-quoted attribute without encoding. As a result, an attacker-controlled value in any allowed attribute (class, style, title, alt, src, href) can include a double-quote character to break out of the attribute and inject an additional attribute, such as a JavaScript event handler (for example onmouseover or onerror). The injected handler survives sanitization and executes when the output is rendered, which is a sanitizer bypass leading to cross-site scripting. The fix in version 0.4.3 HTML-entity-encodes attribute values before serialization.
Which versions are affected by CVE-2026-61784?
2 open source packages ship an affected version, including xhtml-purifier.
| Package | Affected | Fixed in |
|---|---|---|
xhtml-purifier npm | All versions | 0.4.3 |
xhtml-purifier npm | All versions | 0.4.3 |
How do I fix CVE-2026-61784?
Upgrade xhtml-purifier to 0.4.3 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-61784 being exploited?
There is no known exploitation of CVE-2026-61784 in the wild and no public exploit code.
Sources
Also known as GHSA-j8r4-32c5-33rc.