Answer in brief
CVE-2026-61784 records a Medium severity (CVSS 6.1) vulnerability in xhtml-purifier has HTML attribute-injection (sanitizer bypass) that leads to XSS. The current sources do not mark it as known exploited. The current feed maps cstigler/node-xhtml-purifier (generic), xhtml-purifier (npm). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 6.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps cstigler/node-xhtml-purifier (generic), xhtml-purifier (npm). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| cstigler/node-xhtml-purifiergeneric | <0.4.3 | 0.4.3 |
| xhtml-purifiernpm | <=0.4.1 | 0.4.3 |
Published upstream
Sep 24, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 24, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 25, 2026
xhtml-purifier is a Node.js library to take in raw/unknown/untrusted HTML and output cleaned, purified, trusted HTML. Versions prior to 0.4.3 do not HTML-entity-encode attribute values when serializing its sanitized output. In attributeString() (XHTMLPurifier.js, around line 148) the attribute value is concatenated directly into a double-quoted attribute without encoding. As a result, an attacker-controlled value in any allowed attribute (class, style, title, alt, src, href) can include a double-quote character to break out of the attribute and inject an additional attribute, such as a JavaScript event handler (for example onmouseover or onerror). The injected handler survives sanitization and executes when the output is rendered, which is a sanitizer bypass leading to cross-site scripting. The fix in version 0.4.3 HTML-entity-encodes attribute values before serialization.
Quoted source text, attributed separately from HOL analysis.