CVE-2026-61784
1 advisory.
npm/xhtml-purifier CVE-2026-61784: medium 6.1
xhtml-purifier has HTML attribute-injection (sanitizer bypass) that leads to XSS
Action: Upgrade xhtml-purifier to 0.4.3 or later.
npm i xhtml-purifier@0.4.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.4.3 | - |
Fixed versions
| 0.4.3 |
Sources
- osv: GHSA-j8r4-32c5-33rc
- https://github.com/cstigler/node-xhtml-purifier/security/advisories/GHSA-j8r4-32c5-33rc
- https://nvd.nist.gov/vuln/detail/CVE-2026-61784
- https://github.com/cstigler/node-xhtml-purifier/pull/6
- https://github.com/cstigler/node-xhtml-purifier/commit/21d461ad23e7bc9b3073693d5b51b9b8662044d3
- https://github.com/cstigler/node-xhtml-purifier
- https://github.com/cstigler/node-xhtml-purifier/releases/tag/v0.4.3
CVE-2026-61784 · published · modified · JSON