CVE-2026-104828

HtmlUnit Neko is an HtmlUnit adaptation of NekoHTML. Prior to 5.4.0, HTMLWriterFilter writes decoded TEXTAREA and TITLE character content without entity encoding because both elements are treated as special content. During a parse-and-serialize round trip, entity references inside these escapable raw-text elements are decoded by the parser and then emitted as raw markup by printCharacters(), changing the document's semantics. Applications that use htmlunit-neko in an HTML sanitizer, content filter, or other parse-transform-serialize pipeline can therefore turn attacker-controlled encoded text into executable markup when the output is rendered by a browser. This issue is fixed in version 5.4.0.

• CWE-79

• https://github.com/HtmlUnit/htmlunit-neko/commit/c165891e0753aef3e05f5daa6250d3e8d4ada3c0
• https://github.com/HtmlUnit/htmlunit-neko/releases/tag/5.4.0
• https://github.com/HtmlUnit/htmlunit-neko/security/advisories/GHSA-39xg-prhf-8785
• https://github.com/HtmlUnit/htmlunit-neko/security/advisories/GHSA-39xg-prhf-8785

Published

Oct 15, 2026

Last Modified

Oct 21, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-104810This vulnerability allows remote attackers to delete sensiti…8.4
• CVE-2026-104811DigitalCanion SA has discovered a vulnerability that allows …8.4
• CVE-2026-104814Unauthenticated Cross Site Scripting (XSS) in Form Block <= …7.1
• CVE-2026-104816Misskey is an open source, federated social media platform. …8.5
• CVE-2026-104817Misskey is an open source, federated social media platform. …8.7
• CVE-2026-104827react/http is an event-driven, streaming HTTP client and ser…7.5
• CVE-2026-104841Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-104843uv is a Python package and project manager written in Rust. …5.9
• CVE-2026-104844PostCSS Selector Parser is a CSS selector parser that integr…5.9
• CVE-2026-104845Seroval facilitates JS value stringification, including comp…7.5
• CVE-2026-104846Seroval facilitates JS value stringification, including comp…9.8
• CVE-2026-104847ProseMirror's view component renders and manages the editabl…8.5