XSS in Htmlunit Htmlunit-Neko
CVE-2026-104828
HtmlUnit Neko is an HtmlUnit adaptation of NekoHTML. Prior to 5.4.0, HTMLWriterFilter writes decoded TEXTAREA and TITLE character content without entity encoding because both elements are treated as special content. During a parse-and-serialize round trip, entity references inside these escapable raw-text elements are decoded by the parser and then emitted as raw markup by printCharacters(), changing the document's semantics. Applications that use htmlunit-neko in an HTML sanitizer, content filter, or other parse-transform-serialize pipeline can therefore turn attacker-controlled encoded text into executable markup when the output is rendered by a browser. This issue is fixed in version 5.4.0.
Vulnerability class: XSS (Cross-Site Scripting)
Published .
CVSS v3 metric
CVSS v3 base score 7.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
- Htmlunit Htmlunit-Neko — versions < 5.4.0
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-104828?
- CVE-2026-104828 is a high-severity vulnerability in Htmlunit Htmlunit-Neko, classified under Cross-site Scripting. CVSS score: 7.2/10. Published 2026-10-15.
- How severe is CVE-2026-104828?
- High severity. CVSS v3 base score is 7.2 out of 10.