Vulnerability · Published Oct 15, 2026 · Assigned by GitHub_M

CVE-2026-104828HtmlUnit Neko: Mutation XSS (mXSS) in HTMLWriterFilter - TEXTAREA/TITLE entity decode without re-encode

High 7.2

In plain English

A high-severity cross-site scripting in htmlunit-neko from HtmlUnit. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).

Severity (CVSS 3.1)7.2High

Exploit odds (30 days)0.3%top 74.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

HtmlUnit Neko is an HtmlUnit adaptation of NekoHTML. Prior to 5.4.0, HTMLWriterFilter writes decoded TEXTAREA and TITLE character content without entity encoding because both elements are treated as special content. During a parse-and-serialize round trip, entity references inside these escapable raw-text elements are decoded by the parser and then emitted as raw markup by printCharacters(), changing the document's semantics. Applications that use htmlunit-neko in an HTML sanitizer, content filter, or other parse-transform-serialize pipeline can therefore turn attacker-controlled encoded text into executable markup when the output is rendered by a browser. This issue is fixed in version 5.4.0.

Affected products (as reported)

Vendor	Product	Versions
HtmlUnit	htmlunit-neko	< 5.4.0

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

References

https://github.com/HtmlUnit/htmlunit-neko/security/advisories/GHSA-39xg-prhf-8785 x_refsource_CONFIRM
https://github.com/HtmlUnit/htmlunit-neko/commit/c165891e0753aef3e05f5daa6250d3e8d4ada3c0 x_refsource_MISC
https://github.com/HtmlUnit/htmlunit-neko/releases/tag/5.4.0 x_refsource_MISC