---
id: CVE-2026-61784
title: >-
  xhtml-purifier is a Node.js library to take in raw/unknown/untrusted HTML and
  output cleaned, purified, trusted HTML
summary: >-
  xhtml-purifier is a Node.js library to take in raw/unknown/untrusted HTML and
  output cleaned, purified, trusted HTML. Versions prior to 0.4.3 do not
  HTML-entity-encode attribute values when serializing its sanitized output. In
  attributeS…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
cwe:
  - CWE-79
  - CWE-116
vendor: xhtml-purifier
product: xhtml-purifier
affected:
  - xhtml-purifier <= 0.4.1
patched:
  - xhtml-purifier 0.4.3
published: '2026-09-24'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T19:17:15.023'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-61784'
references:
  - url: >-
      https://github.com/cstigler/node-xhtml-purifier/commit/21d461ad23e7bc9b3073693d5b51b9b8662044d3
    label: security-advisories@github.com
  - url: >-
      https://github.com/cstigler/node-xhtml-purifier/security/advisories/GHSA-j8r4-32c5-33rc
    label: security-advisories@github.com
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-61784'
  - url: 'https://github.com/cstigler/node-xhtml-purifier/pull/6'
  - url: 'https://github.com/cstigler/node-xhtml-purifier/releases/tag/v0.4.3'
  - url: 'https://github.com/advisories/GHSA-j8r4-32c5-33rc'
tags:
  - nvd
  - ghsa
  - npm
  - cve.org
aliases:
  - GHSA-j8r4-32c5-33rc
ecosystem: npm
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-24T18:02:51.787487Z'
ingestedAt: '2026-09-24T17:48:30.403Z'
---

## Overview

xhtml-purifier is a Node.js library to take in raw/unknown/untrusted HTML and output cleaned, purified, trusted HTML. Versions prior to 0.4.3 do not HTML-entity-encode attribute values when serializing its sanitized output. In attributeString() (XHTMLPurifier.js, around line 148) the attribute value is concatenated directly into a double-quoted attribute without encoding. As a result, an attacker-controlled value in any allowed attribute (class, style, title, alt, src, href) can include a double-quote character to break out of the attribute and inject an additional attribute, such as a JavaScript event handler (for example onmouseover or onerror). The injected handler survives sanitization and executes when the output is rendered, which is a sanitizer bypass leading to cross-site scripting. The fix in version 0.4.3 HTML-entity-encodes attribute values before serialization.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-61784)

Affected packages:

- `xhtml-purifier <= 0.4.1`

Patched in:

- `xhtml-purifier 0.4.3`

Source: https://github.com/advisories/GHSA-j8r4-32c5-33rc