CVE-2026-61784 in node-xhtml-purifier
Summary
by MITRE • 09/24/2026
xhtml-purifier is a Node.js library to take in raw/unknown/untrusted HTML and output cleaned, purified, trusted HTML. Versions prior to 0.4.3 do not HTML-entity-encode attribute values when serializing its sanitized output. In attributeString() (XHTMLPurifier.js, around line 148) the attribute value is concatenated directly into a double-quoted attribute without encoding. As a result, an attacker-controlled value in any allowed attribute (class, style, title, alt, src, href) can include a double-quote character to break out of the attribute and inject an additional attribute, such as a JavaScript event handler (for example onmouseover or onerror). The injected handler survives sanitization and executes when the output is rendered, which is a sanitizer bypass leading to cross-site scripting. The fix in version 0.4.3 HTML-entity-encodes attribute values before serialization.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/24/2026
The xhtml-purifier library for Node.js serves as a critical security component designed to sanitize untrusted HTML input by stripping malicious tags and attributes while preserving safe content. Versions prior to 0.4.3 contain a significant implementation flaw in the sanitization logic that undermines its primary purpose of preventing cross-site scripting attacks. The vulnerability resides specifically within the attributeString function located in XHTMLPurifier.js, where the library attempts to serialize sanitized HTML back into string format for output or further processing. During this serialization phase, the code concatenates attribute values directly into double-quoted strings without applying necessary HTML entity encoding. This oversight means that any special characters present in an allowed attribute value are preserved as-is rather than being converted into their safe encoded equivalents.
This technical flaw allows attackers to bypass the sanitizer through a technique known as attribute injection or quote breaking. When processing attributes such as class, style, title, alt, src, or href, if an attacker can control the input value and includes a double-quote character within it, they can terminate the intended attribute context prematurely. For instance, if a user provides a value for the alt attribute that contains a closing double quote followed by malicious JavaScript code in another event handler attribute like onerror or onmouseover, the resulting HTML structure becomes malformed in favor of the attacker. The browser interprets this modified markup as having an additional, unsanitized attribute containing executable script code. Because the sanitizer does not encode these characters during output serialization, the injected payload survives the cleaning process and remains intact when rendered by a web client.
The operational impact of this vulnerability is severe, leading directly to cross-site scripting (XSS) attacks against users who view content processed by vulnerable versions of xhtml-purifier. An attacker can craft malicious HTML input that, once sanitized and displayed in a victim's browser, executes arbitrary JavaScript code within the context of the trusted domain hosting the application. This capability enables session hijacking, credential theft, defacement, or further malware distribution depending on the sensitivity of the data accessible to the script execution environment. The flaw represents a classic case of improper output encoding which is categorized under CWE-79 in the Common Weakness Enumeration standards as Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. Furthermore, this attack vector aligns with MITRE ATT&CK technique T1059.007, specifically JavaScript execution via browser-based attacks, illustrating how a failure to properly encode output can facilitate the initial access and execution phases of an intrusion kill chain.
To mitigate this vulnerability, organizations must immediately upgrade xhtml-purifier to version 0.4.3 or later where the attributeString function has been corrected to HTML-entity-encode all attribute values before serialization. This ensures that special characters such as double quotes are converted into their corresponding entity references like quot, preventing them from being interpreted as structural delimiters in the resulting HTML. For applications unable to upgrade immediately due to dependency constraints, implementing a secondary sanitization layer or custom output encoding middleware is recommended to ensure all dynamic content rendered in attributes undergoes proper escaping. Developers should also adopt defense-in-depth strategies by validating input types strictly and ensuring that any user-supplied data destined for attribute contexts is consistently encoded using context-appropriate methods such as HTML entity encoding for general attributes or CSS value encoding where applicable. Regular security audits of third-party dependencies are essential to maintain the integrity of web application defenses against evolving XSS techniques.