{"action":"Upgrade defuddle to 0.9.0 or later.","affected":[{"fixed":"0.9.0","introduced":"0"}],"component":"defuddle","cve_ids":["CVE-2026-30830"],"ecosystem":"npm","epss":0.00268,"exploited":false,"fixed_versions":["0.9.0"],"ghsa_id":"GHSA-5mq8-78gm-pjmq","id":"tcs_01M5KF46WPWKFQ5T1AMQX2G8EG","modified_at":"2026-07-20T21:46:41.489404441Z","published_at":"2026-03-06T18:39:35Z","references":["https://osv.dev/vulnerability/GHSA-5mq8-78gm-pjmq","https://github.com/kepano/defuddle/security/advisories/GHSA-5mq8-78gm-pjmq","https://nvd.nist.gov/vuln/detail/CVE-2026-30830","https://github.com/kepano/defuddle/commit/f154cb740ee603431b69638273af737a27156df9","https://github.com/kepano/defuddle"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-5mq8-78gm-pjmq","url":"https://osv.dev/vulnerability/GHSA-5mq8-78gm-pjmq"}],"summary":"defuddle vulnerable to XSS via unescaped string interpolation in _findContentBySchemaText image tag"}