LazyHTML’s parsing and serialization process treats text inside style or script elements that appear within SVG or MathML foreign content as raw text. When the library converts HTML to text, neutralises them incorrectly, attackers can inject markup that is later decoded and rendered as executable JavaScript after a round‑trip through lazy_html. The consequence is mutation XSS, allowing an attacker to run arbitrary code in the browser context of any user who views the rendered content. Based on the description, it is inferred that such code execution could enable credential theft, session hijacking, or other malicious actions.

Dashbitco’s LazyHTML library, versions 0.1.0 through 0.1.12 inclusive, are affected. Any application that relies on these releases to parse, filter, or transform HTML content before rendering to a browser may be vulnerable.

The CVSS score of 2.3 indicates a low severity, although the context of use determines the real impact. The lack of an EPSS score means we cannot determine the probability of exploitation at this time, and the vulnerability is not listed in CISA KEV, indicating no known large‑scale exploitation. The likely attack vector involves an application accepting untrusted HTML, passing it through LazyHTML’s to_html or Tree.to_html, and ultimately displaying the output. An attacker could craft malicious SVG or MathML markup that contains embedded style or script elements with payload code, causing the text to be emitted unescaped and executed in the victim’s browser. The impact is confined to the application’s rendering context; based on typical XSS consequences, it is inferred that the severity could increase if the page has elevated privileges.