CVE-2026-92106 Details
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dashbitco lazy_html allows mutation XSS via a parse and serialize round-trip of attacker-supplied HTML. LazyHTML.to_html/2 and LazyHTML.Tree.to_html/2 decide whether to escape an element's text from its tag name alone. A style or script element inside SVG or MathML foreign content is parsed with character references decoded, but is serialized as an HTML raw-text element, so its text is emitted unescaped. Encoded markup such as </style><img src=x onerror=...> inside <svg><style> therefore closes the element on re-parse and becomes live markup. Applications that parse untrusted HTML with lazy_html, filter the document or tree, and serialize it for display are affected, since the payload is a plain text node that no element or attribute filter sees. This issue affects lazy_html: from 0.1.0 before 0.1.13.
A cross-site scripting vulnerability has been identified in the Dashbitco Lazy_HTML library, specifically in versions 0.1.0 prior to 0.1.13. This vulnerability allows for mutation XSS by manipulating how the library parses and serializes HTML. The issue arises because Lazy_HTML's serialization of SVG and MathML 'style' or 'script' elements does not properly escape text, enabling the injection of executable markup. When untrusted HTML is processed with Lazy_HTML, filtered, and then serialized for display, the vulnerability can be exploited. The problem lies in the text-node emission path, where the library fails to recognize and escape potentially harmful content, such as an image tag with an 'onerror' attribute, effectively bypassing any tree-based sanitization.
Users can update to Lazy_HTML version 0.1.13 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 25, 2026CISA-ADP
Assessed Sep 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cna.erlef.org/cves/CVE-2026-92106.html | EEF | AdvisoryPermission Required |
| https://github.com/dashbitco/lazy_html/commit/1dee15746c024916b3110af8b168c2f3b3065fbd | EEF | Source CodeVendor |
| https://github.com/dashbitco/lazy_html/commit/f32c7fd6223225b68bc8691c78b6d4a77972f1d5 | EEF | Source CodeVendor |
| https://github.com/dashbitco/lazy_html/security/advisories/GHSA-8rqp-v692-v82q | EEF | AdvisoryExploitRemedyVendor |
| https://osv.dev/vulnerability/EEF-CVE-2026-92106 | EEF | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | EEF |
Affected Products
| Product | Versions |
|---|---|
| dashbitco lazy_html | >= 0.1.0, < 0.1.13 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 25, 2026 | CVE Modified | CISA-ADP |
| Sep 25, 2026 | New CVE Received | EEF |