Changes for version 1.09 - 2026-08-06
- Treat the contents of the RCDATA/RAWTEXT "text" elements <title>, <textarea>, <noembed> and <noframes> as opaque text (like <script>/ <style>), consuming up to the matching end tag instead of parsing comments and nested tags inside them. Fixes an XSS bypass where a literal end tag plus active markup could be smuggled inside what the defanger treated as an inert comment or attribute value, e.g. <title><!-- </title> <img src=x onerror=alert(1)> --></title>
Modules
Cleans HTML as well as CSS of scripting and other executable contents, and neutralises XSS attacks.