CVE-2026-92106: lazy_html serializes SVG and MathML style and script text unescaped, allowing mutation XSS
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dashbitco lazyhtml allows mutation XSS via a parse and serialize round-trip of attacker-supplied HTML.
LazyHTML.tohtml/2 and LazyHTML.Tree.tohtml/2 decide whether to escape an element's text from its tag name alone. A style or script element inside SVG or MathML foreign content is parsed with character references decoded, but is serialized as an HTML raw-text element, so its text is emitted unescaped. Encoded markup such as </style><img src=x onerror=...> inside <svg><style> therefore closes the element on re-parse and becomes live markup. Applications that parse untrusted HTML with lazyhtml, filter the document or tree, and serialize it for display are affected, since the payload is a plain text node that no element or attribute filter sees.
This issue affects lazyhtml: from 0.1.0 before 0.1.13.
Affected Software
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications are affected when they parse attacker-controlled HTML with lazy_html, optionally filter the document or tree, and then serialize it for display. Filters limited to elements or attributes may miss the payload because it is initially represented as a plain text node.
What does an attacker need to exploit it?
An attacker needs a way to supply HTML that the application sends through a lazy_html parse-and-serialize round trip. The payload uses encoded markup in a style or script element within SVG or MathML foreign content, which can become active markup when the serialized output is parsed again.
Are all lazy_html versions affected?
Versions from 0.1.0 before 0.1.13 are affected. Version 0.1.13 is not listed as affected.
How can I determine whether my application is vulnerable?
Check whether your application uses LazyHTML.to_html/2 or LazyHTML.Tree.to_html/2 after parsing untrusted HTML, especially where the resulting HTML is rendered in a browser. Test whether encoded closing tags and markup inside SVG or MathML style or script content are emitted unescaped and become live elements after browser parsing.