CVE-2026-30830: 
JavaScript vulnerability analysis and mitigation

CVE-2026-30830 is a Cross-Site Scripting (XSS) vulnerability in the defuddle npm library (by kepano) caused by unescaped string interpolation in the _findContentBySchemaText method. It affects all versions of defuddle prior to 0.9.0 (specifically <= 0.7.0 as the vulnerable range). The vulnerability was published on March 5, 2026, and assigned a CVSS v3.1 base score of 6.1 (Medium) and a CVSS v4.0 base score of 2.1 (Low) (GitHub Advisory). Any application that renders defuddle's HTML output — including browser extensions, web clippers, and reader modes — is potentially affected (GitHub Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation). The vulnerable code in src/defuddle.ts uses JavaScript template literals to interpolate image src and alt attributes directly into an HTML string without escaping: html += \<img src="${imageSrc}" alt="${imageAlt}">`. Because getAttribute('alt')returns the raw attribute value, an attacker who controls a page'salt attribute can embed a double-quote character (") to break out of the attribute context and inject arbitrary HTML attributes such as event handlers (e.g., onload="alert(document.cookie)"). Critically, this injection occurs during string construction — not in the DOM — so the existing _stripUnsafeElements()sanitizer (which stripson*attributes from DOM elements) cannot intercept it, because theonloadhandler is created synthetically by the interpolation and never appears as a standalone DOM attribute namedon*([GitHub Advisory](https://github.com/kepano/defuddle/security/advisories/GHSA-5mq8-78gm-pjmq), [Patch Commit](https://github.com/kepano/defuddle/commit/f154cb740ee603431b69638273af737a27156df9)). Exploitation requires triggering the_findContentBySchemaText` fallback path, which activates when schema.org structured data word count exceeds the extracted content word count.

Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript in the context of the user's browser within any application that renders defuddle's HTML output, such as browser extensions, web clippers, or reader mode implementations. The impact is primarily to the subsequent (browser) system context: low confidentiality impact (e.g., cookie or session token theft) and low integrity impact (e.g., DOM manipulation or phishing content injection), with no availability impact. Because defuddle is commonly used in note-taking and content-clipping tools, exploitation could lead to session hijacking or credential theft for users of those applications (GitHub Advisory).

A proof-of-concept (PoC) exploit is publicly available in the GitHub Security Advisory, demonstrating the full input/output chain with crafted HTML that injects an onload event handler via a malicious alt attribute (GitHub Advisory). The EPSS score is approximately 0.015% (6th percentile), indicating a low current probability of exploitation in the wild. There is no evidence of active in-the-wild exploitation or threat actor attribution at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction (a victim must process or view the crafted HTML through a defuddle-powered application) but requires no privileges from the attacker (Feedly).

1. Craft malicious HTML: Create an HTML page containing a <script type="application/ld+json"> block with schema.org structured data (e.g., @type: Article) whose text field contains a large amount of text — enough words to exceed the word count of the page's visible content, triggering the _findContentBySchemaText fallback in defuddle.
2. Add a sibling image with a malicious alt attribute: Place an <img> element as a sibling to the content element, with an alt attribute containing a double-quote followed by an event handler payload, e.g., alt='pwned" onload="alert(document.cookie)'.
3. Host or deliver the page: Serve the crafted HTML to a victim, or embed it in a context where a defuddle-powered application (browser extension, web clipper, reader mode) will process it — for example, by sharing a link to the malicious page.
4. Trigger defuddle processing: The victim opens or clips the page using the vulnerable application. Defuddle's _findContentBySchemaText method reads the image's alt attribute via getAttribute('alt') and interpolates it unsanitized into a template literal, producing output such as <img src="..." alt="pwned" onload="alert(document.cookie)">.
5. JavaScript executes: When the application renders defuddle's HTML output, the browser parses the injected onload attribute and executes the attacker's JavaScript payload in the user's browser context, enabling cookie theft, session hijacking, or further malicious actions (GitHub Advisory).

• Network: Outbound requests from a browser extension or reader-mode application to unexpected external domains (e.g., attacker-controlled servers) immediately after processing a web page — potentially carrying stolen cookies or session tokens as query parameters.
• Logs: Browser console errors or network requests triggered by onload, onerror, or similar event handlers on <img> elements rendered by defuddle-powered applications.
• File System / Extension Storage: Unexpected modifications to browser extension local storage or cookies following use of a defuddle-based web clipper on an untrusted page.
• DOM Artifacts: Presence of <img> elements in defuddle-rendered output containing on* event handler attributes (e.g., onload, onerror) — these should not appear in sanitized output and indicate exploitation or a vulnerable version (GitHub Advisory).

Update defuddle to version 0.9.0 or later, which resolves the vulnerability by replacing unsafe template literal string interpolation with DOM API calls (createElement, setAttribute, outerHTML), ensuring attribute values are properly escaped by the DOM serializer (GitHub Advisory, Patch Commit). As a defense-in-depth measure, implement a strict Content Security Policy (CSP) in applications that render defuddle output to restrict inline script and event handler execution. Additionally, validate and sanitize all HTML input before passing it to defuddle, and avoid rendering defuddle output from untrusted sources without additional sanitization.

The vulnerability was reported by researcher TinkAnet and published by the defuddle maintainer (kepano) on March 5, 2026, with a patch released in the same disclosure (GitHub Advisory). Red Hat acknowledged the CVE on March 9, 2026. No significant broader media coverage or notable community discussion beyond the GitHub advisory has been identified.