153 matches found
CVE-2026-104828
HtmlUnit Neko is an HtmlUnit adaptation of NekoHTML. Prior to 5.4.0, HTMLWriterFilter writes decoded TEXTAREA and TITLE character content without entity encoding because both elements are treated as special content. During a parse-and-serialize round trip, entity references inside these escapable...
CVE-2026-104828
Prior to version 5.4.0 , HtmlUnit Neko (an adaptation of NekoHTML) is vulnerable to Mutation XSS (mXSS) in the HTMLWriterFilter component. The root cause is that the filter writes decoded TEXTAREA and TITLE character content without re-encoding because these elements are treated as special conten...
PT-2026-115114
Name of the Vulnerable Software and Affected Versions HtmlUnit Neko versions prior to 5.4.0 Description HtmlUnit Neko, an adaptation of NekoHTML, contains an issue where the HTMLWriterFilter writes decoded TEXTAREA and TITLE character content without entity encoding. This occurs because both...
CLSA-2025-1766534901 TuxCare security update for net.sourceforge.htmlunit:htmlunit (1 CVE)
TuxCare rebuilt net.sourceforge.htmlunit:htmlunit to address 1 CVE. Fixed in 2.70.0-tuxcare.1...
ROOT-APP-MAVEN-CVE-2023-26119 CVE-2023-26119 in io.root.net.sourceforge.htmlunit:htmlunit - Patched by Root
Root has patched CVE-2023-26119 in the io.root.net.sourceforge.htmlunit:htmlunit package for Root:Maven. Multiple fixed versions available...
com.github.seykron:htmlunit-runner-freemarker (1.0), org.springframework:spring-mock (2.0) +1 more potentially affected by CVE-2026-41853 via org.springframework:spring-webmvc (2.0)
org.springframework:spring-webmvc MAVEN version 2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.github.seykron:htmlunit-runner-freemarker 1.0 - org.springframework:spring-mock 2.0 -...
com.github.seykron:htmlunit-runner-freemarker (1.0), org.springframework:spring-mock (2.0) +1 more potentially affected by CVE-2026-41843 via org.springframework:spring-webmvc (2.0)
org.springframework:spring-webmvc MAVEN version 2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.github.seykron:htmlunit-runner-freemarker 1.0 - org.springframework:spring-mock 2.0 -...
com.github.seykron:htmlunit-runner-freemarker (1.0), org.springframework:spring-mock (2.0) +1 more potentially affected by CVE-2026-41842 via org.springframework:spring-webmvc (2.0)
org.springframework:spring-webmvc MAVEN version 2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.github.seykron:htmlunit-runner-freemarker 1.0 - org.springframework:spring-mock 2.0 -...
Ubuntu 16.04 LTS / 18.04 LTS : HtmlUnit vulnerability (USN-8220-1)
The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-8220-1 advisory. It was discovered that HtmlUnit was vulnerable to remote code execution via XSLT when browsing an attacker-controlled webpage. An attacker could...
htmlunit:HtmlParserFuzzer: Security exception in org.htmlunit.cyberneko.HTMLTagBalancer.endElement
Project: https://github.com/HtmlUnit/htmlunit.git Detailed Report: https://oss-fuzz.com/testcase?key=5166667581947904 Project: htmlunit Fuzzing Engine: libFuzzer Fuzz Target: HtmlParserFuzzer Job Type: libfuzzerasanhtmlunit Platform Id: linux Crash Type: Security exception Crash Address: Crash...
USN-8220-1: HtmlUnit vulnerability
It was discovered that HtmlUnit was vulnerable to remote code execution via XSLT when browsing an attacker-controlled webpage. An attacker could possibly use this issue to execute arbitrary code in the context of the application using HtmlUnit...
USN-8220-1 htmlunit vulnerability
It was discovered that HtmlUnit was vulnerable to remote code execution via XSLT when browsing an attacker-controlled webpage. An attacker could possibly use this issue to execute arbitrary code in the context of the application using HtmlUnit...
PT-2026-39176
Name of the Vulnerable Software and Affected Versions HtmlUnit affected versions not specified Description Remote code execution is possible via XSLT Extensible Stylesheet Language Transformations, a language used to transform XML documents when browsing a webpage controlled by an attacker. This...
com.github.seykron:htmlunit-runner-freemarker (1.0), org.springframework:spring-mock (2.0) +1 more potentially affected by CVE-2026-22745 via org.springframework:spring-webmvc (2.0)
org.springframework:spring-webmvc MAVEN version 2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.github.seykron:htmlunit-runner-freemarker 1.0 - org.springframework:spring-mock 2.0 -...
OSV-2026-535 Security exception in org.htmlunit.cyberneko.HTMLTagBalancer.endElement
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=499447433 Crash type: Security exception Crash state: org.htmlunit.cyberneko.HTMLTagBalancer.endElement java.base/sun.nio.cs.CESU8.updatePositions java.base/sun.nio.cs.CESU8$Encoder.encodeArrayLoop...
PT-2026-38533
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=499447433 Crash type: Security exception Crash state: org.htmlunit.cyberneko.HTMLTagBalancer.endElement java.base/sun.nio.cs.CESU 8.updatePositions java.base/sun.nio.cs.CESU 8$Encoder.encodeArrayLoop...
htmlunit:HtmlParserFuzzer: Security exception in org.htmlunit.cyberneko.HTMLTagBalancer.endElement
Project: https://github.com/HtmlUnit/htmlunit.git Detailed Report: https://oss-fuzz.com/testcase?key=5387673824198656 Project: htmlunit Fuzzing Engine: libFuzzer Fuzz Target: HtmlParserFuzzer Job Type: libfuzzerasanhtmlunit Platform Id: linux Crash Type: Security exception Crash Address: Crash...
OSV-2026-76 Security exception in org.htmlunit.cyberneko.HTMLTagBalancer.endElement
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=476170180 Crash type: Security exception Crash state: org.htmlunit.cyberneko.HTMLTagBalancer.endElement org.htmlunit.cyberneko.HTMLElements$HTMLElementsWithCache.getElement...
PT-2026-33472
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=476170180 Crash type: Security exception Crash state: org.htmlunit.cyberneko.HTMLTagBalancer.endElement org.htmlunit.cyberneko.HTMLElements$HTMLElementsWithCache.getElement...
htmlunit:HtmlParserFuzzer: Security exception in org.htmlunit.cyberneko.HTMLTagBalancer.endElement
Project: https://github.com/HtmlUnit/htmlunit.git Detailed Report: https://oss-fuzz.com/testcase?key=4533216651575296 Project: htmlunit Fuzzing Engine: libFuzzer Fuzz Target: HtmlParserFuzzer Job Type: libfuzzerasanhtmlunit Platform Id: linux Crash Type: Security exception Crash Address: Crash...