CVE-2026-61784: 
JavaScript 취약성 분석 및 완화

CVE-2026-61784 is an HTML attribute-injection vulnerability in the xhtml-purifier Node.js library (npm package) that allows attackers to bypass HTML sanitization and achieve cross-site scripting (XSS). The flaw affects all versions up to and including 0.4.1, and was first published by the maintainer on June 24, 2026, with NVD publication on September 24, 2026. The patched version is 0.4.3. It carries a CVSS v3.1 base score of 6.1 (Medium) (Github Advisory).

The root cause is improper output encoding (CWE-116) leading to XSS (CWE-79). In XHTMLPurifier.js, the attributeString() function (around line 148) concatenates attribute values directly into double-quoted HTML attributes without HTML-entity encoding. An attacker who controls the value of any allowed attribute — class, style, title, alt, src, or href — can embed a double-quote character (") to break out of the attribute context and inject arbitrary additional attributes, such as JavaScript event handlers (onmouseover, onerror, etc.). The injected handler is not stripped by the sanitizer because the injection occurs during serialization after the sanitization pass, and it executes when the output is rendered in a browser (Github Advisory, Fix Commit).

Successful exploitation allows an unauthenticated attacker to inject and execute arbitrary JavaScript in the context of a victim user's browser when they view a page rendering the sanitized HTML output. This can lead to session hijacking, credential theft, unauthorized actions performed on behalf of the user, and defacement of web content. The scope is marked as "Changed" in CVSS, indicating that the impact extends beyond the vulnerable component itself to the user's browser environment (Github Advisory).

No public proof-of-concept exploit code has been observed, and there is no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction (a victim must render the attacker-controlled, sanitized HTML), but requires no authentication or special privileges from the attacker. The EPSS score is approximately 0.168%, indicating a low probability of exploitation in the near term (Github Advisory).

1. Identify target application: Find a web application that uses the xhtml-purifier npm package (versions ≤ 0.4.1) to sanitize user-supplied HTML before rendering it to other users (e.g., a comment system, rich-text editor, or user profile field).
2. Craft malicious input: Construct an HTML snippet where an allowed attribute value contains a double-quote to break out of the attribute context and inject an event handler. For example: <img src="valid.png" alt="x" onmouseover="alert(document.cookie)" — submitted as alt="x" onmouseover="alert(document.cookie)".
3. Submit the payload: Submit the crafted HTML through the application's input mechanism (e.g., a comment form or profile bio field). The xhtml-purifier sanitizer processes the input but, due to the missing encoding in attributeString(), serializes the injected event handler into the output unchanged.
4. Trigger execution: Induce a victim user to visit the page where the sanitized output is rendered. When the browser parses the page, the injected event handler (e.g., onmouseover) becomes a live attribute and executes the attacker's JavaScript payload upon user interaction or page load.
5. Achieve objective: Use the executed JavaScript to steal session cookies, perform actions as the victim, exfiltrate sensitive data, or redirect the user to a malicious site (Github Advisory, Fix Commit).

• Logs: Web server or application logs showing user-submitted content containing double-quote characters within HTML attribute values (e.g., alt="x" onmouseover=), particularly in fields that accept HTML input.
• Application Output: Rendered HTML pages containing unexpected event handler attributes (onmouseover, onerror, onclick, etc.) on elements that passed through xhtml-purifier sanitization.
• Network: Outbound requests from user browsers to unexpected external domains (e.g., for cookie exfiltration) originating from pages that render xhtml-purifier-sanitized content.
• File System / Dependencies: Presence of xhtml-purifier npm package at version ≤ 0.4.1 in node_modules or package-lock.json / yarn.lock files (Github Advisory).

Update the xhtml-purifier npm package to version 0.4.3 or later, which HTML-entity-encodes attribute values in attributeString() before serialization, preventing quote-breaking injection. No configuration-based workaround is available for the vulnerable versions; upgrading is the only reliable fix. Developers should audit all applications and dependency trees for use of affected versions and update immediately (Github Advisory, Fix Commit).