CVE-2026-30830

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-30830", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-05T21:06:44.606Z", "datePublished": "2026-03-07T05:49:15.964Z", "dateUpdated": "2026-03-10T17:58:06.614Z"}, "containers": {"cna": {"title": "Defuddle: XSS via unescaped string interpolation in _findContentBySchemaText image tag", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "baseScore": 2.1, "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P", "version": "4.0"}}], "references": [{"name": "https://github.com/kepano/defuddle/security/advisories/GHSA-5mq8-78gm-pjmq", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/kepano/defuddle/security/advisories/GHSA-5mq8-78gm-pjmq"}, {"name": "https://github.com/kepano/defuddle/commit/f154cb740ee603431b69638273af737a27156df9", "tags": ["x_refsource_MISC"], "url": "https://github.com/kepano/defuddle/commit/f154cb740ee603431b69638273af737a27156df9"}], "affected": [{"vendor": "kepano", "product": "defuddle", "versions": [{"version": "< 0.9.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-07T05:49:15.964Z"}, "descriptions": [{"lang": "en", "value": "Defuddle cleans up HTML pages. Prior to version 0.9.0, the _findContentBySchemaText method in src/defuddle.ts interpolates image src and alt attributes directly into an HTML string without escaping. An attacker can use a \" in the alt attribute to break out of the attribute context and inject event handler. This issue has been patched in version 0.9.0."}], "source": {"advisory": "GHSA-5mq8-78gm-pjmq", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-10T17:45:32.483501Z", "id": "CVE-2026-30830", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-10T17:58:06.614Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-30830", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-10T17:45:32.483501Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-10T17:50:26.268Z"}}], "cna": {"title": "Defuddle: XSS via unescaped string interpolation in _findContentBySchemaText image tag", "source": {"advisory": "GHSA-5mq8-78gm-pjmq", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 2.1, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "kepano", "product": "defuddle", "versions": [{"status": "affected", "version": "< 0.9.0"}]}], "references": [{"url": "https://github.com/kepano/defuddle/security/advisories/GHSA-5mq8-78gm-pjmq", "name": "https://github.com/kepano/defuddle/security/advisories/GHSA-5mq8-78gm-pjmq", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/kepano/defuddle/commit/f154cb740ee603431b69638273af737a27156df9", "name": "https://github.com/kepano/defuddle/commit/f154cb740ee603431b69638273af737a27156df9", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Defuddle cleans up HTML pages. Prior to version 0.9.0, the _findContentBySchemaText method in src/defuddle.ts interpolates image src and alt attributes directly into an HTML string without escaping. An attacker can use a \" in the alt attribute to break out of the attribute context and inject event handler. This issue has been patched in version 0.9.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-07T05:49:15.964Z"}}}, "cveMetadata": {"cveId": "CVE-2026-30830", "state": "PUBLISHED", "dateUpdated": "2026-03-10T17:58:06.614Z", "dateReserved": "2026-03-05T21:06:44.606Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-07T05:49:15.964Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "defuddle", "vendor": "kepano", "versions": [{"status": "affected", "version": "< 0.9.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:kepano:defuddle:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "5C6B0D6B-FD90-43C8-B413-A323503AA149", "versionEndExcluding": "0.9.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Defuddle cleans up HTML pages. Prior to version 0.9.0, the _findContentBySchemaText method in src/defuddle.ts interpolates image src and alt attributes directly into an HTML string without escaping. An attacker can use a \" in the alt attribute to break out of the attribute context and inject event handler. This issue has been patched in version 0.9.0."}, {"lang": "es", "value": "Defuddle limpia p\u00e1ginas HTML. Antes de la versi\u00f3n 0.9.0, el m\u00e9todo _findContentBySchemaText en src/defuddle.ts interpola los atributos src y alt de las im\u00e1genes directamente en una cadena HTML sin escapar. Un atacante puede usar una ' en el atributo alt para salir del contexto del atributo e inyectar un gestor de eventos. Este problema ha sido parcheado en la versi\u00f3n 0.9.0."}], "id": "CVE-2026-30830", "lastModified": "2026-06-17T10:32:59.390", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-30830", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-10T17:45:32.483501Z", "version": "2.0.3"}}]}, "published": "2026-03-07T06:16:11.163", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/kepano/defuddle/commit/f154cb740ee603431b69638273af737a27156df9"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/kepano/defuddle/security/advisories/GHSA-5mq8-78gm-pjmq"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.9.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "defuddle", "source": "cna", "vendor": "kepano"}, "product": "defuddle", "vendor": "kepano"}], "analysis": {"en": {"generated_at": "2026-04-17T12:13:49.677726+00:00", "value": {"mitigation_remediation": ["Upgrade Defuddle to version 0.9.0 or later to apply the vendor patch.", "Sanitize or escape any image alt attributes or other user\u2011supplied data that will be embedded in HTML by _findContentBySchemaText before rendering.", "Enable a browser\u2011side Content Security Policy or implement web\u2011filtering to block inline scripts and monitor for anomalous XSS payloads."], "summary": {"action": "Apply Patch", "impact": "Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "The vendor kepano provides Defuddle. All releases prior to 0.9.0 contain the flaw; the patch is available in version 0.9.0 and later.", "description_and_impact": "Defuddle 0.x users are exposed to reflected cross\u2011site scripting when the _findContentBySchemaText method interpolates image src and alt attributes directly into an HTML string. Because the alt attribute is not escaped, an attacker can insert a double quote, break out of the attribute context, and inject an event handler that runs client\u2011side JavaScript. The weakness is a classic unescaped user input defect (CWE\u201179). An affected user who views the crafted HTML will have arbitrary script executed in their browser, leading to theft of credentials, session hijacking, or page defacement.", "risk_and_exploitability": "The CVSS score of 2.1 indicates low severity, and the EPSS score of less than 1\u202f% suggests a low probability of exploitation. Defuddle is not registered in CISA\u2019s known\u2011exploited list. Exploitation requires an attacker to supply or modify data that will be rendered by Defuddle into a user\u2019s browser; no authentication or privileged access is required. The attack vector is client\u2011side via crafted image tags, making it possible for a malicious page or email attachment to trigger the flaw."}}}}, "created": "2026-03-09T10:05:46.885070+00:00", "updated": "2026-04-17T12:15:18.175503+00:00", "vendors": ["kepano", "kepano$PRODUCT$defuddle"]}