CVE-2026-104828

Name of the Vulnerable Software and Affected Versions HtmlUnit Neko versions prior to 5.4.0

Description HtmlUnit Neko, an adaptation of NekoHTML, contains an issue where the HTMLWriterFilter writes decoded TEXTAREA and TITLE character content without entity encoding. This occurs because both elements are treated as special content. During a parse-and-serialize round trip, entity references within these raw-text elements are decoded by the parser and subsequently emitted as raw markup by the printCharacters() function, which alters the document semantics. Applications utilizing htmlunit-neko in an HTML sanitizer, content filter, or parse-transform-serialize pipeline may allow attacker-controlled encoded text to be converted into executable markup when rendered by a browser.

Recommendations Update to version 5.4.0.