CVE-2026-92106 in lazy_html
Summary
by MITRE • 09/25/2026
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dashbitco lazy_html allows mutation XSS via a parse and serialize round-trip of attacker-supplied HTML.
LazyHTML.to_html/2 and LazyHTML.Tree.to_html/2 decide whether to escape an element's text from its tag name alone. A style or script element inside SVG or MathML foreign content is parsed with character references decoded, but is serialized as an HTML raw-text element, so its text is emitted unescaped. Encoded markup such as </style><img src=x onerror=...> inside <svg><style> therefore closes the element on re-parse and becomes live markup. Applications that parse untrusted HTML with lazy_html, filter the document or tree, and serialize it for display are affected, since the payload is a plain text node that no element or attribute filter sees.
This issue affects lazy_html: from 0.1.0 before 0.1.13.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/25/2026
The vulnerability identified as Improper Neutralization of Input During Web Page Generation, commonly known as Cross-site Scripting (XSS), resides within the lazy_html library for Elixir applications. This specific flaw arises from an inconsistency in how HTML elements are parsed and subsequently serialized back into a string representation. The core issue is rooted in the decision logic used by LazyHTML.to_html/2 and LazyHTML.Tree.to_html/2 functions, which determine whether to escape text content based solely on the element's tag name rather than its contextual namespace or parent structure. This simplistic approach fails to account for special parsing rules associated with foreign content elements such as SVG and MathML, leading to a dangerous mutation XSS scenario where attacker-supplied HTML can be transformed into executable script during a parse-and-serialize round-trip.
In standard HTML5 parsing algorithms, certain elements like style and script are treated as raw text data when they appear inside specific contexts, particularly within foreign content such as SVG or MathML tags. When lazy_html parses an input document containing these structures, it correctly decodes character references within the text nodes of these elements. However, during the serialization phase, the library incorrectly treats these same nodes as standard HTML raw-text elements without applying necessary escaping for their specific context. Consequently, if an attacker injects encoded markup such as </style><img src=x onerror=...> inside a <svg><style> block, the parser decodes this into literal characters </style><img src=x onerror=...>. When serialized back to HTML, these characters are emitted unescaped. This results in the closure of the style element and the injection of an img tag with an event handler that executes arbitrary JavaScript code upon rendering by a web browser.
The operational impact of this vulnerability is significant for any application that utilizes lazy_html to parse untrusted HTML input, apply filtering or sanitization logic, and then serialize the result for display in a user interface. Because the malicious payload exists as plain text within a node during the parsing phase, standard element-based or attribute-based filters may not detect it if they do not specifically inspect the content of style nodes inside SVG contexts. The filter sees only benign-looking text data, allowing the payload to pass through unchanged until serialization transforms it into active, executable markup. This effectively bypasses many common sanitization strategies that rely on structural analysis rather than deep semantic context awareness, leading to successful cross-site scripting attacks when the output is rendered in a browser environment.
From a classification perspective, this vulnerability aligns with CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Specifically, it represents an edge case where input neutralization fails due to context switching between parsing and serialization phases. In terms of the MITRE ATT&CK framework, this technique falls under T1059.007: JavaScript via Browser API, as it leverages browser-specific rendering behaviors to execute malicious scripts. The attack vector is primarily remote if the application accepts user-supplied HTML content for processing, making it a critical concern for web applications that allow rich text input or document upload features without rigorous validation of serialized output contexts.
Mitigation strategies must address both the immediate code defect and broader architectural practices regarding untrusted data handling. For developers using lazy_html, upgrading to version 0.1.13 or later is essential as this release corrects the serialization logic for foreign content elements. Beyond library updates, applications should implement defense-in-depth measures by validating serialized output against a strict allowlist of permitted tags and attributes rather than relying solely on blacklist-based filtering. Additionally, employing Content Security Policy (CSP) headers can significantly reduce the impact of any residual XSS vulnerabilities by restricting the sources from which scripts can be loaded or executed. Regular security audits focusing on HTML sanitization pipelines are recommended to ensure that parsing and serialization contexts remain consistent throughout the data lifecycle.