EEF-CVE-2026-92106

See a problem?
Please try reporting it to the source first.
Source
https://cna.erlef.org/osv/EEF-CVE-2026-92106.html
Import Source
https://cna.erlef.org/osv/EEF-CVE-2026-92106.json
JSON Data
https://api.test.osv.dev/v1/vulns/EEF-CVE-2026-92106
Aliases
  • CVE-2026-92106
  • GHSA-8rqp-v692-v82q
Published
2026-09-25T09:33:13Z
Modified
2026-09-25T14:00:18Z
Severity
  • 2.3 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator
Summary
lazy_html serializes SVG and MathML style and script text unescaped, allowing mutation XSS
Details

Summary

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dashbitco lazy_html allows mutation XSS via a parse and serialize round-trip of attacker-supplied HTML.

LazyHTML.to_html/2 and LazyHTML.Tree.to_html/2 decide whether to escape an element's text from its tag name alone. A style or script element inside SVG or MathML foreign content is parsed with character references decoded, but is serialized as an HTML raw-text element, so its text is emitted unescaped. Encoded markup such as &lt;/style&gt;&lt;img src=x onerror=...&gt; inside <svg><style> therefore closes the element on re-parse and becomes live markup. Applications that parse untrusted HTML with lazy_html, filter the document or tree, and serialize it for display are affected, since the payload is a plain text node that no element or attribute filter sees.

This issue affects lazy_html: from 0.1.0 before 0.1.13.

Impact

An attacker who can submit HTML to an application that sanitizes it with lazy_html can run script in the browsers of users who view the sanitized output.

Database specific 
{
    "capec_ids": [
        "CAPEC-63"
    ],
    "cpe_ids": [
        "cpe:2.3:a:dashbitco:lazy_html:*:*:*:*:*:*:*:*"
    ],
    "cwe_ids": [
        "CWE-79"
    ]
}
References
Credits
    • Peter Ullrich - REPORTER
    • Jonatan Kłosko - REMEDIATION_DEVELOPER
    • Jonatan Männchen / EEF - ANALYST
    • José Valim - ANALYST

Affected packages

Hex / lazy_html

Package

Name
lazy_html
Purl
pkg:hex/lazy_html

Affected ranges

Type
SEMVER
Events
Introduced
0.1.0
Fixed
0.1.13

Affected versions

0.*
0.1.0
0.1.1
0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
0.1.9
0.1.10
0.1.11
0.1.12

Database specific

source 
"https://cna.erlef.org/osv/EEF-CVE-2026-92106.json"

Git / github.com/dashbitco/lazy_html

Affected ranges

Type
GIT
Repo
https://github.com/dashbitco/lazy_html
Events
Introduced
1dee15746c024916b3110af8b168c2f3b3065fbd
Fixed
f32c7fd6223225b68bc8691c78b6d4a77972f1d5

Affected versions

v0.*
v0.1.0
v0.1.1
v0.1.10
v0.1.11
v0.1.12
v0.1.2
v0.1.3
v0.1.4
v0.1.5
v0.1.6
v0.1.7
v0.1.8
v0.1.9

Database specific

source 
"https://cna.erlef.org/osv/EEF-CVE-2026-92106.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "90580969371312759060218553849842762155",
                "280370715495015491356308257904647850745",
                "313156110902979146990051129963006853764",
                "76688445630280347675906510080577143580"
            ],
            "threshold": 0.9
        },
        "id": "EEF-CVE-2026-92106-3b362797",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/dashbitco/lazy_html/commit/f32c7fd6223225b68bc8691c78b6d4a77972f1d5",
        "target": {
            "file": "c_src/lazy_html.cpp"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "310579417436848425715483271822210258623",
            "length": 301
        },
        "id": "EEF-CVE-2026-92106-48a8e963",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/dashbitco/lazy_html/commit/f32c7fd6223225b68bc8691c78b6d4a77972f1d5",
        "target": {
            "file": "c_src/lazy_html.cpp",
            "function": "is_noescape_text_node"
        }
    }
]
vanir_signatures_modified 
"2026-09-25T14:00:18Z"