{"action":"Upgrade defuddle to 0.19.1 or later.","affected":[{"fixed":"0.19.1","introduced":"0"}],"component":"defuddle","cve_ids":["CVE-2026-61824"],"ecosystem":"npm","epss":0.0041,"exploited":false,"fixed_versions":["0.19.1"],"ghsa_id":"GHSA-jg4p-g6xj-4qmf","id":"tcs_01M5KFXYA147TN074D2WHJC7DM","modified_at":"2026-08-21T21:10:59.866904Z","published_at":"2026-08-21T20:54:56Z","references":["https://osv.dev/vulnerability/GHSA-jg4p-g6xj-4qmf","https://github.com/kepano/defuddle/security/advisories/GHSA-jg4p-g6xj-4qmf","https://github.com/kepano/defuddle/pull/326","https://github.com/kepano/defuddle/commit/baf2eaef61d334ef595b28c89e5c5e89e52daf7f","https://github.com/kepano/defuddle","https://github.com/kepano/defuddle/releases/tag/0.19.1"],"severity":{"label":"high","score":8.2},"sources":[{"source":"osv","source_id":"GHSA-jg4p-g6xj-4qmf","url":"https://osv.dev/vulnerability/GHSA-jg4p-g6xj-4qmf"}],"summary":"Defuddle vulnerable to XSS via unescaped attribute interpolation in site extractors"}