HtmlUnit Neko’s HTMLWriterFilter emits decoded CONTENT for TEXTAREA and TITLE elements without re‑encoding. When input containing encoded entity references is parsed and then re‑serialized, those entities are turned into raw markup, changing the document’s semantics. An attacker can supply encoded text that is later rendered as executable code, enabling cross‑site scripting in any application that uses htmlunit‑neko to sanitize or transform HTML.

The vulnerability exists in HtmlUnit:htmlunit‑neko versions prior to 5.4.0. All releases of the library before the 5.4.0 tag are affected.

The CVSS score of 7.2 indicates a high‑severity risk. Although the EPSS score is reported as < 1% and the vulnerability is not listed in the CISA KEV catalog, exploitation is possible in environments where untrusted input is processed by the library and then output to a browser. The likely attack path involves an attacker supplying encoded payloads that the library decodes and re‑serializes, turning them into executable markup. Proper patching or mitigation is therefore recommended to prevent XSS.