CVE-2026-104828 Details
Description
HtmlUnit Neko is an HtmlUnit adaptation of NekoHTML. Prior to 5.4.0, HTMLWriterFilter writes decoded TEXTAREA and TITLE character content without entity encoding because both elements are treated as special content. During a parse-and-serialize round trip, entity references inside these escapable raw-text elements are decoded by the parser and then emitted as raw markup by printCharacters(), changing the document's semantics. Applications that use htmlunit-neko in an HTML sanitizer, content filter, or other parse-transform-serialize pipeline can therefore turn attacker-controlled encoded text into executable markup when the output is rendered by a browser. This issue is fixed in version 5.4.0.
A mutation cross-site scripting (mXSS) vulnerability has been identified in HtmlUnit Neko, specifically in versions prior to 5.4.0. The issue arises in the HTMLWriterFilter, which processes TEXTAREA and TITLE elements as 'special' content. During this process, entity references are decoded and then output as raw HTML, altering the document's semantics. This flaw allows encoded text to be transformed into executable markup when rendered in a browser. The vulnerability is particularly concerning for applications using htmlunit-neko in HTML sanitization or content filtering, as it can lead to the execution of injected scripts.
Users can upgrade to HtmlUnit Neko version 5.4.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 15, 2026CISA-ADP
Assessed Oct 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/HtmlUnit/htmlunit-neko/security/advisories/GHSA-39xg-prhf-8785 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/HtmlUnit/htmlunit-neko/commit/c165891e0753aef3e05f5daa6250d3e8d4ada3c0 | [email protected] | Source CodeVendor |
| https://github.com/HtmlUnit/htmlunit-neko/releases/tag/5.4.0 | [email protected] | Release NotesVendor |
| https://github.com/HtmlUnit/htmlunit-neko/security/advisories/GHSA-39xg-prhf-8785 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| HtmlUnit Neko | < 5.4.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 21, 2026 | CVE Modified | CISA-ADP |
| Oct 15, 2026 | New CVE Received | [email protected] |