240 matches found
CVE-2026-104828
HtmlUnit Neko is an HtmlUnit adaptation of NekoHTML. Prior to 5.4.0, HTMLWriterFilter writes decoded TEXTAREA and TITLE character content without entity encoding because both elements are treated as special content. During a parse-and-serialize round trip, entity references inside these escapable...
EUVD-2026-102316
HtmlUnit Neko is an HtmlUnit adaptation of NekoHTML. Prior to 5.4.0, HTMLWriterFilter writes decoded TEXTAREA and TITLE character content without entity encoding because both elements are treated as special content. During a parse-and-serialize round trip, entity references inside these escapable...
CVE-2026-104828 HtmlUnit Neko: Mutation XSS (mXSS) in HTMLWriterFilter - TEXTAREA/TITLE entity decode without re-encode
HtmlUnit Neko is an HtmlUnit adaptation of NekoHTML. Prior to 5.4.0, HTMLWriterFilter writes decoded TEXTAREA and TITLE character content without entity encoding because both elements are treated as special content. During a parse-and-serialize round trip, entity references inside these escapable...
CVE-2026-104828 HtmlUnit Neko: Mutation XSS (mXSS) in HTMLWriterFilter - TEXTAREA/TITLE entity decode without re-encode
HtmlUnit Neko is an HtmlUnit adaptation of NekoHTML. Prior to 5.4.0, HTMLWriterFilter writes decoded TEXTAREA and TITLE character content without entity encoding because both elements are treated as special content. During a parse-and-serialize round trip, entity references inside these escapable...
au.gov.qld.services.selenium:selenium-helper (>=4.46.0.001, <=4.46.0.002), com.nordstrom.ui-tools:htmlunit-remote (4.46.0) +5 more potentially affected by CVE-2026-104828 via org.htmlunit:neko-htmlunit (5.3.0)
org.htmlunit:neko-htmlunit MAVEN version 5.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.htmlunit:neko-htmlunit and may be impacted: - au.gov.qld.services.selenium:selenium-helper =4.46.0.001, =26.8.0, =26.8.0, =26.8.0, =26.8.1 -...
CVE-2026-104828 HtmlUnit Neko: Mutation XSS (mXSS) in HTMLWriterFilter - TEXTAREA/TITLE entity decode without re-encode
HtmlUnit Neko is an HtmlUnit adaptation of NekoHTML. Prior to 5.4.0, HTMLWriterFilter writes decoded TEXTAREA and TITLE character content without entity encoding because both elements are treated as special content. During a parse-and-serialize round trip, entity references inside these escapable...
CVE-2026-104828
Prior to version 5.4.0 , HtmlUnit Neko (an adaptation of NekoHTML) is vulnerable to Mutation XSS (mXSS) in the HTMLWriterFilter component. The root cause is that the filter writes decoded TEXTAREA and TITLE character content without re-encoding because these elements are treated as special conten...
CVE-2026-104828
HtmlUnit Neko is an HtmlUnit adaptation of NekoHTML. Prior to 5.4.0, HTMLWriterFilter writes decoded TEXTAREA and TITLE character content without entity encoding because both elements are treated as special content. During a parse-and-serialize round trip, entity references inside these escapable...
PT-2026-115114
Name of the Vulnerable Software and Affected Versions HtmlUnit Neko versions prior to 5.4.0 Description HtmlUnit Neko, an adaptation of NekoHTML, contains an issue where the HTMLWriterFilter writes decoded TEXTAREA and TITLE character content without entity encoding. This occurs because both...
CVE-2026-104828: Improper Neutralization of Input During Web Page Generation
HtmlUnit Neko is an HtmlUnit adaptation of NekoHTML. Prior to 5.4.0, HTMLWriterFilter writes decoded TEXTAREA and TITLE character content without entity encoding because both elements are treated as special content. During a parse-and-serialize round trip, entity references inside these escapable...
Htmlunit-NekoHtml Parser Cross-site Scripting Vulnerability
The Htmlunit-NekoHtml Parser versions prior to 5.4.0 have a cross-site scripting vulnerability. This vulnerability arises from HTMLWriterFilter not encoding entities correctly when writing TEXTAREA and TITLE character content. During parsing and serialization, entity references are decoded by the...
htmlunit:HtmlParserFuzzer: Security exception in org.htmlunit.cyberneko.HTMLTagBalancer.reopenFormattingElements
Project: https://github.com/HtmlUnit/htmlunit.git Detailed Report: https://oss-fuzz.com/testcase?key=6115630739947520 Project: htmlunit Fuzzing Engine: libFuzzer Fuzz Target: HtmlParserFuzzer Job Type: libfuzzerasanhtmlunit Platform Id: linux Crash Type: Security exception Crash Address: Crash...
CLSA-2025-1766534901 TuxCare security update for net.sourceforge.htmlunit:htmlunit (1 CVE)
TuxCare rebuilt net.sourceforge.htmlunit:htmlunit to address 1 CVE. Fixed in 2.70.0-tuxcare.1...
ROOT-APP-MAVEN-CVE-2023-26119 CVE-2023-26119 in io.root.net.sourceforge.htmlunit:htmlunit - Patched by Root
Root has patched CVE-2023-26119 in the io.root.net.sourceforge.htmlunit:htmlunit package for Root:Maven. Multiple fixed versions available...
com.github.seykron:htmlunit-runner-freemarker (1.0), org.springframework:spring-mock (2.0) +1 more potentially affected by CVE-2026-41853 via org.springframework:spring-webmvc (2.0)
org.springframework:spring-webmvc MAVEN version 2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.github.seykron:htmlunit-runner-freemarker 1.0 - org.springframework:spring-mock 2.0 -...
com.github.seykron:htmlunit-runner-freemarker (1.0), org.springframework:spring-mock (2.0) +1 more potentially affected by CVE-2026-41846 via org.springframework:spring-webmvc (2.0)
org.springframework:spring-webmvc MAVEN version 2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.github.seykron:htmlunit-runner-freemarker 1.0 - org.springframework:spring-mock 2.0 -...
com.github.seykron:htmlunit-runner-freemarker (1.0), org.springframework:spring-mock (2.0) +1 more potentially affected by CVE-2026-41842 via org.springframework:spring-webmvc (2.0)
org.springframework:spring-webmvc MAVEN version 2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.github.seykron:htmlunit-runner-freemarker 1.0 - org.springframework:spring-mock 2.0 -...
com.github.seykron:htmlunit-runner-freemarker (1.0), org.springframework:spring-mock (2.0) +1 more potentially affected by CVE-2026-41843 via org.springframework:spring-webmvc (2.0)
org.springframework:spring-webmvc MAVEN version 2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.github.seykron:htmlunit-runner-freemarker 1.0 - org.springframework:spring-mock 2.0 -...
Ubuntu 16.04 LTS / 18.04 LTS : HtmlUnit vulnerability (USN-8220-1)
The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-8220-1 advisory. It was discovered that HtmlUnit was vulnerable to remote code execution via XSLT when browsing an attacker-controlled webpage. An attacker could...
htmlunit:HtmlParserFuzzer: Security exception in org.htmlunit.cyberneko.HTMLTagBalancer.endElement
Project: https://github.com/HtmlUnit/htmlunit.git Detailed Report: https://oss-fuzz.com/testcase?key=5166667581947904 Project: htmlunit Fuzzing Engine: libFuzzer Fuzz Target: HtmlParserFuzzer Job Type: libfuzzerasanhtmlunit Platform Id: linux Crash Type: Security exception Crash Address: Crash...