Defuddle constructs HTML strings for extracted article data by inserting page‑derived image alt, src, og:image, and video description values directly into attribute contexts without proper escaping. This omission allows an attacker to craft a malicious page or inject attacker‑controlled content on a matching domain that includes event‑handler attributes or javascript URLs, resulting in code execution when a user or downstream application renders the extracted HTML. The vulnerability is a classic example of CWE‑79 (Cross‑Site Scripting) that can be triggered via reflected or stored payloads in the output products.

The affected product is kepano: defuddle. Versions before 0.19.1 are vulnerable, including the site extractor modules located in src/extractors/x‑article.ts, src/extractors/substack.ts, and src/extractors/youtube.ts. The issue is fixed in the 0.19.1 release.

The CVSS score of 8.2 indicates high severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to control content served on a domain that feeds into the affected extractors, so the attack vector is indirect but realistic in environments that ingest external web content. Given the high impact of XSS and the lack of immediate mitigation, the risk remains significant until a patch is applied.