cstigler vulnerabilities

Products

• node-xhtml-purifier 1

Latest cstigler CVEs

Newest publication first

1. CVE-2026-61784 xhtml-purifier has HTML attribute-injection (sanitizer bypass) that leads to XSS

   Published 2026-09-24

   Medium·CVSS 6.1 EPSS 0.18%

   xhtml-purifier is a Node.js library to take in raw/unknown/untrusted HTML and output cleaned, purified, trusted HTML. Versions prior to 0.4.3 do not HTML-entity-encode attribute values when serializing its sanitized output. In attributeString() (XHTMLPurifier.js, around line 148)...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.