AIKIDO-2026-296759

TL;DR

Several site extractors in defuddle build their output HTML by interpolating untrusted DOM attribute values, such as an image alt, an image src, or a video description read directly off the page, into template-literal strings without escaping. A value containing a quote character closes the attribute and injects new attributes, producing a live event handler or a javascript: URL. Extractor output is returned without passing through the DOM-based sanitizer used elsewhere, so the injected markup reaches the consumer as executable HTML and runs in the browser. The fix routes all extractor output through a central sanitizer that strips unsafe elements and escapes the interpolated values at each sink.