CVE-2026-104828

Status: DeferredHigh (7.2)—

Severity7.2High · CVSS 3.1

Exploitation probability0.26 %higher than 17% of CVEs

Active exploitationNonot in the CISA catalog

Public exploitNot knownno public code found

HtmlUnit Neko is an HtmlUnit adaptation of NekoHTML. Prior to 5.4.0, HTMLWriterFilter writes decoded TEXTAREA and TITLE character content without entity encoding because both elements are treated as special content. During a parse-and-serialize round trip, entity references inside these escapable raw-text elements are decoded by the parser and then emitted as raw markup by printCharacters(), changing the document's semantics. Applications that use htmlunit-neko in an HTML sanitizer, content filter, or other parse-transform-serialize pipeline can therefore turn attacker-controlled encoded text into executable markup when the output is rendered by a browser. This issue is fixed in version 5.4.0.

CVSS

Base score: 7.2
Version: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 0.26 %
Percentile among all scored CVEs: 17
Score date: 10/20/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

ExploitationT1190 Exploit Public-Facing Applicationinitial access60 %
Primary impactT1059.007 JavaScriptexecution55 %

Inferred by deterministic rules from the CVSS vector and CWE. Indicative only.

ATT&CK mitigations that cover these techniques

Vulnerability Scanning Restrict Web-Based Content Privileged Account Management Network Segmentation Limit Access to Resource Over Network Filter Network Traffic

Affected technologies (1)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

Htmlunit — Htmlunit Neko^AI

CWEs

CWE-79

References

Show 4 references

Raw JSON (NVD)

Show

{
  "id": "CVE-2026-104828",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-104828",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-10-21T01:04:22.177553Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 7.2,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "HtmlUnit",
          "product": "htmlunit-neko",
          "versions": [
            {
              "status": "affected",
              "version": "< 5.4.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-10-15T19:17:15.083",
  "references": [
    {
      "url": "https://github.com/HtmlUnit/htmlunit-neko/commit/c165891e0753aef3e05f5daa6250d3e8d4ada3c0",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/HtmlUnit/htmlunit-neko/releases/tag/5.4.0",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/HtmlUnit/htmlunit-neko/security/advisories/GHSA-39xg-prhf-8785",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/HtmlUnit/htmlunit-neko/security/advisories/GHSA-39xg-prhf-8785",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "HtmlUnit Neko is an HtmlUnit adaptation of NekoHTML. Prior to 5.4.0, HTMLWriterFilter writes decoded TEXTAREA and TITLE character content without entity encoding because both elements are treated as special content. During a parse-and-serialize round trip, entity references inside these escapable raw-text elements are decoded by the parser and then emitted as raw markup by printCharacters(), changing the document's semantics. Applications that use htmlunit-neko in an HTML sanitizer, content filter, or other parse-transform-serialize pipeline can therefore turn attacker-controlled encoded text into executable markup when the output is rendered by a browser. This issue is fixed in version 5.4.0."
    }
  ],
  "lastModified": "2026-10-21T01:17:19.770",
  "sourceIdentifier": "security-advisories@github.com"
}