CVE-2026-61784

Name of the Vulnerable Software and Affected Versions xhtml-purifier versions prior to 0.4.3

Description The library fails to HTML-entity-encode attribute values during the serialization of sanitized output. In the attributeString() function, attribute values are concatenated directly into double-quoted attributes without proper encoding. This allows an attacker to use a double-quote character within allowed attributes such as class, style, title, alt, src, or href to break out of the attribute and inject additional attributes, including JavaScript event handlers like onmouseover or onerror. This sanitizer bypass leads to cross-site scripting (XSS), where malicious scripts are executed when the output is rendered.

Recommendations Update to version 0.4.3.