https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 08:56:22 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-92106 <p>Improper Neutralization of Input During Web Page Generation (&#39;Cross-site Scripting&#39;) vulnerability in dashbitco lazy_html allows mutation XSS via a parse and serialize round-trip of attacker-supplied HTML.</p> <p>LazyHTML.to_html/2 and LazyHTML.Tree.to_html/2 decide whether to escape an element&#39;s text from its tag name alone. A style or script element inside SVG or MathML foreign content is parsed with character references decoded, but is serialized as an HTML raw-text element, so its text is emitted unescaped. Encoded markup such as &amp;lt;/style&amp;gt;&amp;lt;img src=x onerror=...&amp;gt; inside &lt;svg&gt;&lt;style&gt; therefore closes the element on re-parse and becomes live markup. Applications that parse untrusted HTML with lazy_html, filter the document or tree, and serialize it for display are affected, since the payload is a plain text node that no element or attribute filter sees.</p> <p>This issue affects lazy_html: from 0.1.0 before 0.1.13.</p> <p>Improper Neutralization of Input During Web Page Generation (&#39;Cross-site Scripting&#39;) vulnerability in dashbitco lazy_html allows mutation XSS via a parse and serialize round-trip of attacker-supplied HTML.</p> <p>LazyHTML.to_html/2 and LazyHTML.Tree.to_html/2 decide whether to escape an element&#39;s text from its tag name alone. A style or script element inside SVG or MathML foreign content is parsed with character references decoded, but is serialized as an HTML raw-text element, so its text is emitted unescaped. Encoded markup such as &amp;lt;/style&amp;gt;&amp;lt;img src=x onerror=...&amp;gt; inside &lt;svg&gt;&lt;style&gt; therefore closes the element on re-parse and becomes live markup. Applications that parse untrusted HTML with lazy_html, filter the document or tree, and serialize it for display are affected, since the payload is a plain text node that no element or attribute filter sees.</p> <p>This issue affects lazy_html: from 0.1.0 before 0.1.13.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-92106