CVE-2026-61824

This vulnerability exposes a silent contract failure in Defuddle's design: the library promises to clean HTML but ships extractors that deliberately bypass its own sanitization layer, then returns that unsanitized content through buildExtractorResponse() without any warning to downstream consumers. The three affected extractors (substack, x-article, youtube) didn't make independent mistakes — they inherited a dangerous pattern from Defuddle's extractor authoring experience. When developers added new extractors, they copied the interpolation patterns from existing ones without realizing those patterns assumed content was already safe. The assumption at authoring time — 'this content comes from the page, not from user input' — breaks completely when the attacker controls the entire page being extracted. The 0.19.1 fix patches the three extractors but doesn't eliminate the underlying architectural problem. buildExtractorResponse() still exists as a bypass path, and any new extractor written without awareness of this pattern inherits the same vulnerability. The library now makes sanitization opt-in at the extractor level, which distributes a security decision to every future extractor author rather than enforcing it centrally. For defenders: verify you're running 0.19.1 or later, but also audit any custom extractors you've added — they may be using the bypass pattern without realizing it. If you consume extractor's output in your application, treat it as potentially unsafe regardless of what the documentation suggests. The blast radius isn't measured by how many extractors have this bug; it's measured by how many downstream applications render that output without re-sanitizing. Assume the contract is broken until proven otherwise.

Reviewed through automated stages and approved by a human before publication.