Listen to this Post
xhtml-purifier is a Node.js library designed to sanitize untrusted HTML by removing dangerous elements and attributes, outputting a purified string that can be safely rendered in a browser. The vulnerability, tracked as CVE-2026-61784, resides in the serialization phase of the sanitization process. Specifically, the `attributeString()` method within `XHTMLPurifier.js` (around line 148) fails to HTML-entity-encode attribute values before concatenating them into a double-quoted attribute string. This omission means that if an attacker can control the value of any allowed attribute—such as class, style, “, alt, src, or href—they can include a double-quote character (") to prematurely close the attribute and inject arbitrary additional attributes. The most critical injection is a JavaScript event handler, like `onmouseover` or onerror. Because the purifier does not strip these newly injected handlers during its sanitization pass, they survive and are written into the final output. When that output is rendered by a web browser, the injected event handler executes in the context of the victim’s session, resulting in a cross-site scripting (XSS) condition. This is a classic sanitizer bypass: the tool is supposed to neutralize malicious input, but the incomplete encoding step allows an attacker to escape the intended attribute and introduce executable script. The root cause is CWE-116 (Improper Encoding or Escaping of Output) and CWE-79 (Improper Neutralization of Input During Web Page Generation). The fix, introduced in version 0.4.3, applies HTML-entity encoding to attribute values before serialization, ensuring that characters like `”` are converted to `"` and cannot break out of the attribute context. The vulnerability has a CVSS 3.1 base score of 6.1, reflecting a medium-severity risk that requires user interaction (e.g., visiting a crafted page) but can lead to partial loss of confidentiality and integrity.
DailyCVE Form:
Platform: node-xhtml-purifier
Version: < 0.4.3
Vulnerability : Attribute Injection XSS
Severity: Moderate
date: Jun 24, 2026
Prediction: 2026-09-24
What Undercode Say:
Check installed version npm list xhtml-purifier Install the vulnerable version for testing npm install [email protected] Inspect the vulnerable function cat node_modules/xhtml-purifier/XHTMLPurifier.js | grep -n "attributeString" -A 10
// Test harness to demonstrate the missing encoding
const XHTMLPurifier = require('xhtml-purifier');
const purifier = new XHTMLPurifier();
const maliciousInput = '
<
div class="foo" style="color:red" ="bar">';
const sanitized = purifier.purify(maliciousInput);
console.log(sanitized);
// Expected vulnerable output:
<
div class="foo" style="color:red" ="bar">
// The value is not encoded, allowing breakout.
Exploit: (Educational Purposes!)
Craft a malicious payload that injects an event handler
node -e "
const XHTMLPurifier = require('xhtml-purifier');
const p = new XHTMLPurifier();
const payload = '
<
div =\"x\" onmouseover=\"alert(document.cookie)\">';
const output = p.purify(payload);
console.log('Sanitized output:', output);
"
<!-- Rendered output in a browser --> <div ="x" onmouseover="alert(document.cookie)"></div> <!-- When a user hovers over the div, the alert executes. -->
Protection: from this CVE
Update to the patched version npm install [email protected] Verify the fix npm list xhtml-purifier Should show 0.4.3 or later.
// Workaround: manually encode attribute values before passing to purifier
// (Not recommended; update instead)
function safePurify(html) {
// Pre-encode double quotes in attribute values – simplistic example
return html.replace(/="([^"])"/g, (match, value) => {
return '="' + value.replace(/"/g, '"') + '"';
});
}
Impact:
An attacker can execute arbitrary JavaScript in the context of a victim’s browser session when the sanitized output is rendered. This enables theft of session cookies, credential harvesting, defacement, or redirection to malicious sites. Because the injected handler survives sanitization, any application that relies on xhtml-purifier to render user-supplied HTML is vulnerable. The CVSS score of 6.1 (Medium) reflects the need for user interaction (e.g., hovering over an element) but the potential for partial confidentiality and integrity loss.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
