CVE-2026-104828: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in HtmlUnit htmlunit-neko
Description
HtmlUnit Neko is an HtmlUnit adaptation of NekoHTML. Prior to 5.4.0, HTMLWriterFilter writes decoded TEXTAREA and TITLE character content without entity encoding because both elements are treated as special content. During a parse-and-serialize round trip, entity references inside these escapable raw-text elements are decoded by the parser and then emitted as raw markup by printCharacters(), changing the document's semantics. Applications that use htmlunit-neko in an HTML sanitizer, content filter, or other parse-transform-serialize pipeline can therefore turn attacker-controlled encoded text into executable markup when the output is rendered by a browser. This issue is fixed in version 5.4.0.
CVSS v3.1
Score 7.2high
Affected software
HtmlUnit
htmlunit-neko
pkg:maven/org.htmlunit/htmlunit-nekoRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
HtmlUnit Neko, an adaptation of NekoHTML used in htmlunit-neko, improperly handles entity encoding for TEXTAREA and TITLE elements before version 5.4.0. During a parse-and-serialize process, entity references inside these escapable raw-text elements are decoded and then output as raw markup, altering the document semantics. This behavior can be exploited in scenarios where htmlunit-neko is used in HTML sanitizers or content filters, potentially allowing execution of attacker-controlled scripts in browsers. The vulnerability is addressed in version 5.4.0.
Potential Impact
This vulnerability allows an attacker to inject executable markup via encoded text in TEXTAREA and TITLE elements, potentially leading to cross-site scripting attacks. The impact includes partial confidentiality and integrity loss (as indicated by CVSS: C:L/I:L) but no availability impact. Exploitation requires no privileges and no user interaction, and the attack can be performed remotely over the network.
Mitigation Recommendations
Upgrade to HtmlUnit htmlunit-neko version 5.4.0 or later, where this issue is fixed. No other mitigation is indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-10-02T14:17:09.335Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ad120372cdf04f656517bba
Added to database: 10/15/2026, 18:49:27 UTC
Last enriched: 10/15/2026, 19:02:45 UTC
Last updated: 10/15/2026, 19:19:21 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.