CVE-2026-92106
Received Received - Intake

Cross-Site Scripting in lazy_html via SVG/MathML parsing

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: EEF

Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dashbitco lazy_html allows mutation XSS via a parse and serialize round-trip of attacker-supplied HTML. LazyHTML.to_html/2 and LazyHTML.Tree.to_html/2 decide whether to escape an element's text from its tag name alone. A style or script element inside SVG or MathML foreign content is parsed with character references decoded, but is serialized as an HTML raw-text element, so its text is emitted unescaped. Encoded markup such as &lt;/style&gt;&lt;img src=x onerror=...&gt; inside <svg><style> therefore closes the element on re-parse and becomes live markup. Applications that parse untrusted HTML with lazy_html, filter the document or tree, and serialize it for display are affected, since the payload is a plain text node that no element or attribute filter sees. This issue affects lazy_html: from 0.1.0 before 0.1.13.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-92106
EUVD
EUVD-2026-86828

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
dashbitco lazy_html From 0.1.0 (inc) to 0.1.13 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-92106 is a Cross-site Scripting (XSS) vulnerability in the lazy_html library affecting versions 0.1.0 to 0.1.12. The issue occurs when the library parses and serializes HTML, improperly escaping style or script elements within SVG or MathML content. Attackers can inject encoded malicious markup (e.g., &lt;/style&gt;&lt;img src=x onerror=...&gt;) that becomes executable script after re-parsing, bypassing sanitization filters.

Detection Guidance

To detect this vulnerability, inspect applications using lazy_html versions 0.1.0 to 0.1.12. Check for untrusted HTML input processing, especially involving SVG or MathML with style/script tags. No specific commands are provided in the context.

Impact Analysis

If you use lazy_html to parse, filter, or sanitize untrusted HTML before rendering it, attackers could exploit this flaw to inject malicious scripts. When other users view the sanitized HTML, the injected scripts may execute in their browsers, potentially stealing data, session cookies, or performing unauthorized actions on their behalf.

Compliance Impact

This XSS vulnerability could lead to unauthorized script execution in user browsers, potentially enabling data theft or manipulation. For GDPR, this may violate Article 32 (security of processing) if personal data is exposed. HIPAA could be affected if protected health information is compromised through such attacks.

Mitigation Strategies

Upgrade lazy_html to version 0.1.13 or later. If upgrading is not possible, avoid using lazy_html to parse or sanitize untrusted HTML. Implement additional external sanitization before rendering.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-92106. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart