local-it/mitgliederverwaltung

Fork 0

chore(deps): update dependency lazy_html to v0.1.13 [security] - autoclosed #578

Closed

renovate wants to merge 1 commit from renovate/hex-lazy_html-vulnerability into main

renovate commented

2026-10-08 14:23:47 +02:00

Collaborator

This PR contains the following updates:

Package	Type	Update	Change
lazy_html (source)	dev	patch	`0.1.11` → `0.1.13`

lazy_html serializes SVG and MathML style and script text unescaped, allowing mutation XSS

CVE-2026-92106 / EEF-CVE-2026-92106 / GHSA-8rqp-v692-v82q

More information

Details

Summary

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dashbitco lazy_html allows mutation XSS via a parse and serialize round-trip of attacker-supplied HTML.

LazyHTML.to_html/2 and LazyHTML.Tree.to_html/2 decide whether to escape an element's text from its tag name alone. A style or script element inside SVG or MathML foreign content is parsed with character references decoded, but is serialized as an HTML raw-text element, so its text is emitted unescaped. Encoded markup such as </style><img src=x onerror=...> inside <svg><style> therefore closes the element on re-parse and becomes live markup. Applications that parse untrusted HTML with lazy_html, filter the document or tree, and serialize it for display are affected, since the payload is a plain text node that no element or attribute filter sees.

This issue affects lazy_html: from 0.1.0 before 0.1.13.

Impact

An attacker who can submit HTML to an application that sanitizes it with lazy_html can run script in the browsers of users who view the sanitized output.

Severity

CVSS Score: 2.3 / 10 (Low)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References

This data is provided by OSV.

Release Notes

dashbitco/lazy_html (lazy_html)

`v0.1.13`

Compare Source

Added

Added LazyHTML.css_path/1 for generating queryable document-relative paths
for selections

Fixed

Fixed to_html/2 functions to escape <style> and <script> content inside SVG and MathML (CVE-2026-92106, GHSA-8rqp-v692-v82q)

`v0.1.12`

Compare Source

Changed

Relaxed elixir_make requirement (#35)

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [lazy_html](https://hex.pm/packages/lazy_html) ([source](https://github.com/dashbitco/lazy_html)) | dev | patch | `0.1.11` → `0.1.13` | --- ### lazy_html serializes SVG and MathML style and script text unescaped, allowing mutation XSS [CVE-2026-92106](https://nvd.nist.gov/vuln/detail/CVE-2026-92106) / EEF-CVE-2026-92106 / [GHSA-8rqp-v692-v82q](https://github.com/advisories/GHSA-8rqp-v692-v82q) <details> <summary>More information</summary> #### Details ##### Summary Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dashbitco lazy_html allows mutation XSS via a parse and serialize round-trip of attacker-supplied HTML. `LazyHTML.to_html/2` and `LazyHTML.Tree.to_html/2` decide whether to escape an element's text from its tag name alone. A `style` or `script` element inside SVG or MathML foreign content is parsed with character references decoded, but is serialized as an HTML raw-text element, so its text is emitted unescaped. Encoded markup such as `</style><img src=x onerror=...>` inside `<svg><style>` therefore closes the element on re-parse and becomes live markup. Applications that parse untrusted HTML with lazy_html, filter the document or tree, and serialize it for display are affected, since the payload is a plain text node that no element or attribute filter sees. This issue affects lazy_html: from 0.1.0 before 0.1.13. ##### Impact An attacker who can submit HTML to an application that sanitizes it with lazy_html can run script in the browsers of users who view the sanitized output. #### Severity - CVSS Score: 2.3 / 10 (Low) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N` #### References - [https://github.com/dashbitco/lazy_html/security/advisories/GHSA-8rqp-v692-v82q](https://github.com/dashbitco/lazy_html/security/advisories/GHSA-8rqp-v692-v82q) - [https://cna.erlef.org/cves/CVE-2026-92106.html](https://cna.erlef.org/cves/CVE-2026-92106.html) - [https://github.com/dashbitco/lazy_html/commit/1dee15746c024916b3110af8b168c2f3b3065fbd](https://github.com/dashbitco/lazy_html/commit/1dee15746c024916b3110af8b168c2f3b3065fbd) - [https://github.com/dashbitco/lazy_html/commit/f32c7fd6223225b68bc8691c78b6d4a77972f1d5](https://github.com/dashbitco/lazy_html/commit/f32c7fd6223225b68bc8691c78b6d4a77972f1d5) - [https://hex.pm/packages/lazy_html](https://hex.pm/packages/lazy_html) This data is provided by [OSV](https://osv.dev/vulnerability/EEF-CVE-2026-92106). </details> --- ### Release Notes <details> <summary>dashbitco/lazy_html (lazy_html)</summary> ### [`v0.1.13`](https://github.com/dashbitco/lazy_html/blob/HEAD/CHANGELOG.md#v0113-2026-09-25) [Compare Source](https://github.com/dashbitco/lazy_html/compare/v0.1.12...v0.1.13) ##### Added - Added `LazyHTML.css_path/1` for generating queryable document-relative paths for selections ##### Fixed - Fixed `to_html/2` functions to escape `<style>` and `<script>` content inside SVG and MathML (CVE-2026-92106, [GHSA-8rqp-v692-v82q](https://github.com/dashbitco/lazy_html/security/advisories/GHSA-8rqp-v692-v82q)) ### [`v0.1.12`](https://github.com/dashbitco/lazy_html/blob/HEAD/CHANGELOG.md#v0112-2026-07-20) [Compare Source](https://github.com/dashbitco/lazy_html/compare/v0.1.11...v0.1.12) ##### Changed - Relaxed `elixir_make` requirement ([#35](https://github.com/dashbitco/lazy_html/pull/35)) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).

renovate added the

security

label

2026-10-08 14:23:47 +02:00

renovate added 1 commit

2026-10-08 14:23:47 +02:00

chore(deps): update dependency lazy_html to v0.1.13 [security]

continuous-integration/drone/push Build was killed

Details

0a0b0410c8

renovate force-pushed renovate/hex-lazy_html-vulnerability from 0a0b0410c8

continuous-integration/drone/push Build was killed

Details

to 1dae8d6fbd

continuous-integration/drone/push Build is passing

Details

2026-10-08 21:24:00 +02:00

Compare

renovate changed title from ~~chore(deps): update dependency lazy_html to v0.1.13 [security]~~ to chore(deps): update dependency lazy_html to v0.1.13 [security] - autoclosed

2026-10-12 12:14:43 +02:00

renovate closed this pull request

2026-10-12 12:14:43 +02:00