CVE-2026-30830 Details

A cross-site scripting (XSS) vulnerability exists in Defuddle versions prior to 0.9.0. The issue arises in the '_findContentBySchemaText' method, which improperly interpolates image 'src' and 'alt' attributes into an HTML string without escaping. This flaw allows an attacker to inject event handlers by exploiting the 'alt' attribute. The vulnerability is triggered when the method processes schema.org structured data, particularly with images containing crafted 'alt' attributes. Although a recent update introduced a sanitization function to remove event-handler attributes from the DOM, this specific injection bypasses those measures by occurring during the HTML string construction, not within the DOM context.

Users can update to Defuddle version 0.9.0 or later, where this vulnerability has been patched.