xhtml-purifier has HTML attribute-injection (sanitizer bypass) that leads to XSS
xhtml-purifier does not HTML-entity-encode attribute values when serializing its sanitized output. In attributeString() (XHTMLPurifier.js, around line 148) the attribute value is concatenated directly into a double-quoted attribute without encoding. As a result, an attacker-controlled value in any allowed attribute (class, style, title, alt, src, href) can include a double-quote character to break out of the attribute and inject an additional attribute, such as a JavaScript event handler (for example onmouseover or onerror). The injected handler survives sanitization and executes when the output is rendered, which is a sanitizer bypass leading to cross-site scripting. The fix HTML-entity-encodes attribute values before serialization.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | xhtml-purifier | < 0.4.3 | 0.4.3 |
References
- https://github.com/cstigler/node-xhtml-purifier/security/advisories/GHSA-j8r4-32c5-33rc
- https://nvd.nist.gov/vuln/detail/CVE-2026-61784
- https://github.com/cstigler/node-xhtml-purifier/pull/6
- https://github.com/cstigler/node-xhtml-purifier/commit/21d461ad23e7bc9b3073693d5b51b9b8662044d3
- https://github.com/cstigler/node-xhtml-purifier
- https://github.com/cstigler/node-xhtml-purifier/releases/tag/v0.4.3
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N- Weakness (CWE)
CWE-116, CWE-79- Platform
- npm
- Package
xhtml-purifier- Disclosed
- 24.09.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-j8r4-32c5-33rc - CC BY 4.0
Vulnerability history: xhtml-purifier
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
This is the only known vulnerability of this package.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.