CVE-2026-30830 LOW

CVE-2026-30830: Defuddle: XSS via unescaped string interpolation in _findContentBySchemaText image tag

Vendor Kepano

Product defuddle

Weakness CWE-79 · XSS

Published March 7, 2026

Last update March 10, 2026

View on NVD All CVEs

CVSS base score

2.1/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction —

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P

What the vulnerability does

01Description

Defuddle cleans up HTML pages. Prior to version 0.9.0, the _findContentBySchemaText method in src/defuddle.ts interpolates image src and alt attributes directly into an HTML string without escaping. An attacker can use a " in the alt attribute to break out of the attribute context and inject event handler. This issue has been patched in version 0.9.0.

Key dates

02Disclosure timeline

March 7, 2026 CVE published

March 10, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-30830 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html

Related vulnerabilities

04Related CVE

CVE-2023-1418 SourceCodester Friendly Island Pizza Website and Ordering System POST Parameter cashconfirm.php cross site scripting CVE-2021-24773 WordPress Download Manager < 3.2.16 - Admin+ Stored Cross-Site Scripting CVE-2025-64745 Astro development server error page vulnerable to reflected Cross-site Scripting CVE-2025-55711 WordPress WP Table Builder Plugin <= 2.0.12 - Cross Site Scripting (XSS) Vulnerability CVE-2022-2065 Cross-site Scripting (XSS) - Stored in neorazorx/facturascripts