CVE-2026-104828

Deferred Deferred - Pending Action

HTMLWriterFilter Entity Encoding Flaw in HtmlUnit Neko

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description

HtmlUnit Neko is an HtmlUnit adaptation of NekoHTML. Prior to 5.4.0, HTMLWriterFilter writes decoded TEXTAREA and TITLE character content without entity encoding because both elements are treated as special content. During a parse-and-serialize round trip, entity references inside these escapable raw-text elements are decoded by the parser and then emitted as raw markup by printCharacters(), changing the document's semantics. Applications that use htmlunit-neko in an HTML sanitizer, content filter, or other parse-transform-serialize pipeline can therefore turn attacker-controlled encoded text into executable markup when the output is rendered by a browser. This issue is fixed in version 5.4.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-16

EPSS Evaluated

2026-10-18

NVD

CVE-2026-104828

EUVD

EUVD-2026-102316

Affected Vendors & Products

Vendor	Product	Version / Range
HtmlUnit	htmlunit-neko	< 5.4.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is a Mutation Cross-Site Scripting (mXSS) issue in the HtmlUnit htmlunit-neko library. It occurs because the HTMLWriterFilter serializes content from textarea and title elements without re-encoding entity references. The parser decodes these references, but the filter writes the decoded content back as raw HTML, allowing malicious payloads to become executable markup during a parse-serialize round-trip.

Detection Guidance

To detect this vulnerability, check if your system uses HtmlUnit htmlunit-neko versions prior to 5.4.0. Run commands like 'mvn dependency:tree' for Maven projects or 'pip show htmlunit-neko' for Python to verify the installed version. If the version is below 5.4.0, the system is vulnerable.

Impact Analysis

Applications using htmlunit-neko for HTML parsing and re-serialization are vulnerable. Attackers can inject entity-encoded payloads that, when processed, break out of textarea or title contexts and execute malicious scripts in a browser. This can lead to XSS attacks, compromising data integrity and confidentiality.

Compliance Impact

This vulnerability could lead to unauthorized script execution, potentially exposing sensitive user data. This may violate GDPR's data protection requirements and HIPAA's security rules for protected health information, depending on the application's use case and data processed.

Mitigation Strategies

Upgrade HtmlUnit htmlunit-neko to version 5.4.0 or later immediately. This version fixes the improper serialization of textarea and title elements by ensuring proper entity encoding. Update dependencies in your project files and redeploy the application.

Hi! I’m here to help you understand CVE-2026-104828. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70