CVE-2026-104828

HIGH 7.2

HtmlUnit Neko: Mutation XSS (mXSS) in HTMLWriterFilter - TEXTAREA/TITLE entity decode without re-encode

CVSS Score

7.2

EPSS Score

0.0%

EPSS Percentile

0th

HtmlUnit Neko is an HtmlUnit adaptation of NekoHTML. Prior to 5.4.0, HTMLWriterFilter writes decoded TEXTAREA and TITLE character content without entity encoding because both elements are treated as special content. During a parse-and-serialize round trip, entity references inside these escapable raw-text elements are decoded by the parser and then emitted as raw markup by printCharacters(), changing the document's semantics. Applications that use htmlunit-neko in an HTML sanitizer, content filter, or other parse-transform-serialize pipeline can therefore turn attacker-controlled encoded text into executable markup when the output is rendered by a browser. This issue is fixed in version 5.4.0.

CWE	CWE-79
Vendor	htmlunit
Product	htmlunit-neko
Published	Oct 15, 2026
Last Updated	Oct 15, 2026

Stay Ahead of the Next One

Get instant alerts for htmlunit htmlunit-neko

Be the first to know when new high vulnerabilities affecting htmlunit htmlunit-neko are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

HtmlUnit / htmlunit-neko

< 5.4.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/HtmlUnit/htmlunit-neko/security/advisories/GHSA-39xg-prhf-8785 github.com: https://github.com/HtmlUnit/htmlunit-neko/commit/c165891e0753aef3e05f5daa6250d3e8d4ada3c0 github.com: https://github.com/HtmlUnit/htmlunit-neko/releases/tag/5.4.0