Threat database

CVE-2026-104828 is a cross-site scripting (XSS) vulnerability in htmlunit-neko, an adaptation of NekoHTML used by HtmlUnit. Versions prior to 5.4.0 improperly handle TEXTAREA and TITLE element content by writing decoded character data without entity encoding. This causes entity references inside these elements to be decoded and emitted as raw markup during parse-and-serialize operations, potentially allowing attacker-controlled encoded text to become executable markup in browsers. The issue is fixed in version 5.4.0.