8 matches found
CVE-2026-92106
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in dashbitco lazyhtml allows mutation XSS via a parse and serialize round-trip of attacker-supplied HTML. LazyHTML.tohtml/2 and LazyHTML.Tree.tohtml/2 decide whether to escape an element's text from i...
CVE-2026-92106 lazy_html serializes SVG and MathML style and script text unescaped, allowing mutation XSS
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in dashbitco lazyhtml allows mutation XSS via a parse and serialize round-trip of attacker-supplied HTML. LazyHTML.tohtml/2 and LazyHTML.Tree.tohtml/2 decide whether to escape an element's text from i...
EUVD-2026-86828
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in dashbitco lazyhtml allows mutation XSS via a parse and serialize round-trip of attacker-supplied HTML. LazyHTML.tohtml/2 and LazyHTML.Tree.tohtml/2 decide whether to escape an element's text from i...
CVE-2026-92106
The dashbitco lazy_html library (versions 0.1.0 before 0.1.13 ) is vulnerable to Mutation XSS due to improper neutralization of input during web page generation. The root cause lies in the LazyHTML.to_html/2 and LazyHTML.Tree.to_html/2 functions, which fail to correctly escape text within style o...
CVE-2026-92106 lazy_html serializes SVG and MathML style and script text unescaped, allowing mutation XSS
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in dashbitco lazyhtml allows mutation XSS via a parse and serialize round-trip of attacker-supplied HTML. LazyHTML.tohtml/2 and LazyHTML.Tree.tohtml/2 decide whether to escape an element's text from i...
EEF-CVE-2026-92106 lazy_html serializes SVG and MathML style and script text unescaped, allowing mutation XSS
Summary Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in dashbitco lazyhtml allows mutation XSS via a parse and serialize round-trip of attacker-supplied HTML. LazyHTML.tohtml/2 and LazyHTML.Tree.tohtml/2 decide whether to escape an element's tex...
CVE-2026-92106 lazy_html serializes SVG and MathML style and script text unescaped, allowing mutation XSS
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in dashbitco lazyhtml allows mutation XSS via a parse and serialize round-trip of attacker-supplied HTML. LazyHTML.tohtml/2 and LazyHTML.Tree.tohtml/2 decide whether to escape an element's text from i...
CVE-2026-92106: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in dashbitco lazyhtml allows mutation XSS via a parse and serialize round-trip of attacker-supplied HTML. LazyHTML.tohtml/2 and LazyHTML.Tree.tohtml/2 decide whether to escape an element's text from i...