Htmlunit Neko
Monthly
Cross-site scripting in HtmlUnit Neko (htmlunit-neko) before 5.4.0 lets an unauthenticated remote attacker smuggle executable markup out of HTML sanitizers and content filters that use the library to serialize parsed HTML. HTMLWriterFilter fails to entity-encode decoded TEXTAREA and TITLE text, so entity-encoded markup supplied inside those elements is decoded on parse and re-emitted as literal markup by printCharacters(); output rendered by a victim's browser executes in that browser, which is why the CVSS 3.1 score of 7.2 (High) carries a scope change (S:C) on the vector AV:N/AC:L/PR:N/UI:N. The flaw is only reachable in a parse-transform-serialize pipeline that both relies on HTMLWriterFilter for its output and renders that output in a browser, and no public exploit code was identified at time of analysis; the issue is fixed in 5.4.0.
Cross-site scripting in HtmlUnit Neko (htmlunit-neko) before 5.4.0 lets an unauthenticated remote attacker smuggle executable markup out of HTML sanitizers and content filters that use the library to serialize parsed HTML. HTMLWriterFilter fails to entity-encode decoded TEXTAREA and TITLE text, so entity-encoded markup supplied inside those elements is decoded on parse and re-emitted as literal markup by printCharacters(); output rendered by a victim's browser executes in that browser, which is why the CVSS 3.1 score of 7.2 (High) carries a scope change (S:C) on the vector AV:N/AC:L/PR:N/UI:N. The flaw is only reachable in a parse-transform-serialize pipeline that both relies on HTMLWriterFilter for its output and renders that output in a browser, and no public exploit code was identified at time of analysis; the issue is fixed in 5.4.0.