{"action":"Upgrade xhtml-purifier to 0.4.3 or later.","affected":[{"fixed":"0.4.3","introduced":"0"}],"component":"xhtml-purifier","cve_ids":["CVE-2026-61784"],"ecosystem":"npm","epss":0.00178,"exploited":false,"fixed_versions":["0.4.3"],"ghsa_id":"GHSA-j8r4-32c5-33rc","id":"tcs_01M5KFXEFJ6TK6V1WDHD3MWH53","modified_at":"2026-09-24T19:45:04.825205046Z","published_at":"2026-09-24T19:33:23Z","references":["https://osv.dev/vulnerability/GHSA-j8r4-32c5-33rc","https://github.com/cstigler/node-xhtml-purifier/security/advisories/GHSA-j8r4-32c5-33rc","https://nvd.nist.gov/vuln/detail/CVE-2026-61784","https://github.com/cstigler/node-xhtml-purifier/pull/6","https://github.com/cstigler/node-xhtml-purifier/commit/21d461ad23e7bc9b3073693d5b51b9b8662044d3","https://github.com/cstigler/node-xhtml-purifier","https://github.com/cstigler/node-xhtml-purifier/releases/tag/v0.4.3"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-j8r4-32c5-33rc","url":"https://osv.dev/vulnerability/GHSA-j8r4-32c5-33rc"}],"summary":"xhtml-purifier has HTML attribute-injection (sanitizer bypass) that leads to XSS"}