dashbitco lazy html vulnerabilities

Latest dashbitco lazy html CVEs

Newest publication first

1. CVE-2026-92106 lazy_html serializes SVG and MathML style and script text unescaped, allowing mutation XSS

   Published 2026-09-25

   Low·CVSS 2.3 EPSS 0.39%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dashbitco lazy_html allows mutation XSS via a parse and serialize round-trip of attacker-supplied HTML. LazyHTML.to_html/2 and LazyHTML.Tree.to_html/2 decide whether to escape an...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.