Defuddle 0.x users are exposed to reflected cross‑site scripting when the _findContentBySchemaText method interpolates image src and alt attributes directly into an HTML string. Because the alt attribute is not escaped, an attacker can insert a double quote, break out of the attribute context, and inject an event handler that runs client‑side JavaScript. The weakness is a classic unescaped user input defect (CWE‑79). An affected user who views the crafted HTML will have arbitrary script executed in their browser, leading to theft of credentials, session hijacking, or page defacement.

The vendor kepano provides Defuddle. All releases prior to 0.9.0 contain the flaw; the patch is available in version 0.9.0 and later.

The CVSS score of 2.1 indicates low severity, and the EPSS score of less than 1 % suggests a low probability of exploitation. Defuddle is not registered in CISA’s known‑exploited list. Exploitation requires an attacker to supply or modify data that will be rendered by Defuddle into a user’s browser; no authentication or privileged access is required. The attack vector is client‑side via crafted image tags, making it possible for a malicious page or email attachment to trigger the flaw.