AIKIDO-2026-970758

TL;DR

defuddle extracts and sanitizes article HTML from untrusted web pages before returning it to consumers. Its URL sanitization only rejects javascript: and data:text/html, so blob: URLs and other data: documents (including data:image/svg+xml used as an iframe src) survive, and the unsafe-attribute strip does not run on the main extraction output when standardization is disabled. An attacker who controls a page or matching-domain content can smuggle a script-bearing document into an attribute that bypasses the script and event-handler stripping and executes when a consumer renders the extracted output, resulting in Cross-Site Scripting. The fix rejects data: and blob: URLs (allowing only inline data:image/* outside an iframe src), runs the unsafe-element strip on the main output unconditionally, and preserves the iframe sandbox attribute.