CVE-2026-104828 HtmlUnit Neko: Mutation XSS (mXSS) in HTMLWriterFilter - TEXTAREA/TITLE entity decode without re-encode
Attackers can execute arbitrary JavaScript via mutation XSS in HtmlUnit Neko when parsing and serializing HTML containing TEXTAREA or TITLE elements.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-104828?
CVE-2026-104828 is a high-severity cross-site scripting vulnerability in htmlunit-neko, published on 15 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
HtmlUnit Neko is an HtmlUnit adaptation of NekoHTML. Prior to 5.4.0, HTMLWriterFilter writes decoded TEXTAREA and TITLE character content without entity encoding because both elements are treated as special content. During a parse-and-serialize round trip, entity references inside these escapable raw-text elements are decoded by the parser and then emitted as raw markup by printCharacters(), changing the document's semantics. Applications that use htmlunit-neko in an HTML sanitizer, content filter, or other parse-transform-serialize pipeline can therefore turn attacker-controlled encoded text into executable markup when the output is rendered by a browser. This issue is fixed in version 5.4.0.
Weakness: CWE-79
Which versions are affected by CVE-2026-104828?
How do I fix CVE-2026-104828?
No fix has been published for CVE-2026-104828 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-104828 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-104828 exists.
Sources
Also known as GHSA-39xg-prhf-8785.