The vulnerability lies in the node-xhtml-purifier library, which fails to HTML‑entity‑encode attribute values when serializing its sanitized output. An attacker‑controlled value placed in any attribute that the library permits can embed a double‑quote to break out of the attribute and inject an event handler such as onmouseover or onerror. The injected handler survives sanitization and executes when the resulting HTML is rendered, leading to cross‑site scripting. The weakness is an instance of CWE‑116 (Improper Encoding) in conjunction with CWE‑79 (XSS).

Node.js applications that depend on cstigler/node‑xhtml‑purifier with a version older than 0.4.3. The library is used to clean untrusted HTML before rendering in a browser. Clients using earlier releases without the patch are vulnerable.

The CVSS base score of 6.1 indicates moderate severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. An attacker can exploit the flaw by injecting malicious attribute values into any context where the library is used to process user input. Successful exploitation requires that the output of node‑xhtml‑purifier is eventually rendered in a browser, where the injected JavaScript will execute. Because the vulnerability bypasses the library’s sanitization, the attack is straightforward once the input is processed by the unpatched version.