lazy_html
Efficient parsing and querying of HTML documents
View on Github
Activity
- Latest release
- 1mo ago
- Total releases
- 14
- Cadence
- ~30 days
- Last 12 months
- 5
Reach
- Downloads
- 3.2M
- Stars
- 106
Details
- License
- Apache-2.0
- First release
- Apr 04, 2025
| Version | Released | |
|---|---|---|
0.1.13
patch
| ||
0.1.12
patch
1 CVE
CVE-2026-92106
EEF-CVE-2026-92106
GHSA-8rqp-v692-v82q
Sep 25, 2026
lazy_html serializes SVG and MathML style and script text unescaped, allowing mutation XSS
Low
Network
Low
None
SummaryImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dashbitco lazy_html allows mutation XSS via a parse and serialize round-trip of attacker-supplied HTML.
This issue affects lazy_html: from 0.1.0 before 0.1.13. ImpactAn attacker who can submit HTML to an application that sanitizes it with lazy_html can run script in the browsers of users who view the sanitized output. Affected versions
0.1.0
0.1.1
0.1.10
0.1.11
0.1.12
0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
+ 1 more Show less
0.1.9
Fixed in
0.1.13
References
Updated Sep 25, 2026 · Source: OSV.dev | ||
0.1.11
patch
1 CVE
CVE-2026-92106
EEF-CVE-2026-92106
GHSA-8rqp-v692-v82q
Sep 25, 2026
lazy_html serializes SVG and MathML style and script text unescaped, allowing mutation XSS
Low
Network
Low
None
SummaryImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dashbitco lazy_html allows mutation XSS via a parse and serialize round-trip of attacker-supplied HTML.
This issue affects lazy_html: from 0.1.0 before 0.1.13. ImpactAn attacker who can submit HTML to an application that sanitizes it with lazy_html can run script in the browsers of users who view the sanitized output. Affected versions
0.1.0
0.1.1
0.1.10
0.1.11
0.1.12
0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
+ 1 more Show less
0.1.9
Fixed in
0.1.13
References
Updated Sep 25, 2026 · Source: OSV.dev | ||
0.1.10
patch
1 CVE
CVE-2026-92106
EEF-CVE-2026-92106
GHSA-8rqp-v692-v82q
Sep 25, 2026
lazy_html serializes SVG and MathML style and script text unescaped, allowing mutation XSS
Low
Network
Low
None
SummaryImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dashbitco lazy_html allows mutation XSS via a parse and serialize round-trip of attacker-supplied HTML.
This issue affects lazy_html: from 0.1.0 before 0.1.13. ImpactAn attacker who can submit HTML to an application that sanitizes it with lazy_html can run script in the browsers of users who view the sanitized output. Affected versions
0.1.0
0.1.1
0.1.10
0.1.11
0.1.12
0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
+ 1 more Show less
0.1.9
Fixed in
0.1.13
References
Updated Sep 25, 2026 · Source: OSV.dev | ||
0.1.9
patch
1 CVE
CVE-2026-92106
EEF-CVE-2026-92106
GHSA-8rqp-v692-v82q
Sep 25, 2026
lazy_html serializes SVG and MathML style and script text unescaped, allowing mutation XSS
Low
Network
Low
None
SummaryImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dashbitco lazy_html allows mutation XSS via a parse and serialize round-trip of attacker-supplied HTML.
This issue affects lazy_html: from 0.1.0 before 0.1.13. ImpactAn attacker who can submit HTML to an application that sanitizes it with lazy_html can run script in the browsers of users who view the sanitized output. Affected versions
0.1.0
0.1.1
0.1.10
0.1.11
0.1.12
0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
+ 1 more Show less
0.1.9
Fixed in
0.1.13
References
Updated Sep 25, 2026 · Source: OSV.dev | ||
0.1.8
patch
1 CVE
CVE-2026-92106
EEF-CVE-2026-92106
GHSA-8rqp-v692-v82q
Sep 25, 2026
lazy_html serializes SVG and MathML style and script text unescaped, allowing mutation XSS
Low
Network
Low
None
SummaryImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dashbitco lazy_html allows mutation XSS via a parse and serialize round-trip of attacker-supplied HTML.
This issue affects lazy_html: from 0.1.0 before 0.1.13. ImpactAn attacker who can submit HTML to an application that sanitizes it with lazy_html can run script in the browsers of users who view the sanitized output. Affected versions
0.1.0
0.1.1
0.1.10
0.1.11
0.1.12
0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
+ 1 more Show less
0.1.9
Fixed in
0.1.13
References
Updated Sep 25, 2026 · Source: OSV.dev | ||
0.1.7
patch
1 CVE
CVE-2026-92106
EEF-CVE-2026-92106
GHSA-8rqp-v692-v82q
Sep 25, 2026
lazy_html serializes SVG and MathML style and script text unescaped, allowing mutation XSS
Low
Network
Low
None
SummaryImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dashbitco lazy_html allows mutation XSS via a parse and serialize round-trip of attacker-supplied HTML.
This issue affects lazy_html: from 0.1.0 before 0.1.13. ImpactAn attacker who can submit HTML to an application that sanitizes it with lazy_html can run script in the browsers of users who view the sanitized output. Affected versions
0.1.0
0.1.1
0.1.10
0.1.11
0.1.12
0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
+ 1 more Show less
0.1.9
Fixed in
0.1.13
References
Updated Sep 25, 2026 · Source: OSV.dev | ||
0.1.6
patch
1 CVE
CVE-2026-92106
EEF-CVE-2026-92106
GHSA-8rqp-v692-v82q
Sep 25, 2026
lazy_html serializes SVG and MathML style and script text unescaped, allowing mutation XSS
Low
Network
Low
None
SummaryImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dashbitco lazy_html allows mutation XSS via a parse and serialize round-trip of attacker-supplied HTML.
This issue affects lazy_html: from 0.1.0 before 0.1.13. ImpactAn attacker who can submit HTML to an application that sanitizes it with lazy_html can run script in the browsers of users who view the sanitized output. Affected versions
0.1.0
0.1.1
0.1.10
0.1.11
0.1.12
0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
+ 1 more Show less
0.1.9
Fixed in
0.1.13
References
Updated Sep 25, 2026 · Source: OSV.dev | ||
0.1.5
patch
1 CVE
CVE-2026-92106
EEF-CVE-2026-92106
GHSA-8rqp-v692-v82q
Sep 25, 2026
lazy_html serializes SVG and MathML style and script text unescaped, allowing mutation XSS
Low
Network
Low
None
SummaryImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dashbitco lazy_html allows mutation XSS via a parse and serialize round-trip of attacker-supplied HTML.
This issue affects lazy_html: from 0.1.0 before 0.1.13. ImpactAn attacker who can submit HTML to an application that sanitizes it with lazy_html can run script in the browsers of users who view the sanitized output. Affected versions
0.1.0
0.1.1
0.1.10
0.1.11
0.1.12
0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
+ 1 more Show less
0.1.9
Fixed in
0.1.13
References
Updated Sep 25, 2026 · Source: OSV.dev | ||
0.1.4
patch
1 CVE
CVE-2026-92106
EEF-CVE-2026-92106
GHSA-8rqp-v692-v82q
Sep 25, 2026
lazy_html serializes SVG and MathML style and script text unescaped, allowing mutation XSS
Low
Network
Low
None
SummaryImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dashbitco lazy_html allows mutation XSS via a parse and serialize round-trip of attacker-supplied HTML.
This issue affects lazy_html: from 0.1.0 before 0.1.13. ImpactAn attacker who can submit HTML to an application that sanitizes it with lazy_html can run script in the browsers of users who view the sanitized output. Affected versions
0.1.0
0.1.1
0.1.10
0.1.11
0.1.12
0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
+ 1 more Show less
0.1.9
Fixed in
0.1.13
References
Updated Sep 25, 2026 · Source: OSV.dev | ||
0.1.3
patch
1 CVE
CVE-2026-92106
EEF-CVE-2026-92106
GHSA-8rqp-v692-v82q
Sep 25, 2026
lazy_html serializes SVG and MathML style and script text unescaped, allowing mutation XSS
Low
Network
Low
None
SummaryImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dashbitco lazy_html allows mutation XSS via a parse and serialize round-trip of attacker-supplied HTML.
This issue affects lazy_html: from 0.1.0 before 0.1.13. ImpactAn attacker who can submit HTML to an application that sanitizes it with lazy_html can run script in the browsers of users who view the sanitized output. Affected versions
0.1.0
0.1.1
0.1.10
0.1.11
0.1.12
0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
+ 1 more Show less
0.1.9
Fixed in
0.1.13
References
Updated Sep 25, 2026 · Source: OSV.dev | ||
0.1.2
patch
1 CVE
CVE-2026-92106
EEF-CVE-2026-92106
GHSA-8rqp-v692-v82q
Sep 25, 2026
lazy_html serializes SVG and MathML style and script text unescaped, allowing mutation XSS
Low
Network
Low
None
SummaryImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dashbitco lazy_html allows mutation XSS via a parse and serialize round-trip of attacker-supplied HTML.
This issue affects lazy_html: from 0.1.0 before 0.1.13. ImpactAn attacker who can submit HTML to an application that sanitizes it with lazy_html can run script in the browsers of users who view the sanitized output. Affected versions
0.1.0
0.1.1
0.1.10
0.1.11
0.1.12
0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
+ 1 more Show less
0.1.9
Fixed in
0.1.13
References
Updated Sep 25, 2026 · Source: OSV.dev | ||
0.1.1
patch
1 CVE
CVE-2026-92106
EEF-CVE-2026-92106
GHSA-8rqp-v692-v82q
Sep 25, 2026
lazy_html serializes SVG and MathML style and script text unescaped, allowing mutation XSS
Low
Network
Low
None
SummaryImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dashbitco lazy_html allows mutation XSS via a parse and serialize round-trip of attacker-supplied HTML.
This issue affects lazy_html: from 0.1.0 before 0.1.13. ImpactAn attacker who can submit HTML to an application that sanitizes it with lazy_html can run script in the browsers of users who view the sanitized output. Affected versions
0.1.0
0.1.1
0.1.10
0.1.11
0.1.12
0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
+ 1 more Show less
0.1.9
Fixed in
0.1.13
References
Updated Sep 25, 2026 · Source: OSV.dev | ||
0.1.0
initial
1 CVE
CVE-2026-92106
EEF-CVE-2026-92106
GHSA-8rqp-v692-v82q
Sep 25, 2026
lazy_html serializes SVG and MathML style and script text unescaped, allowing mutation XSS
Low
Network
Low
None
SummaryImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dashbitco lazy_html allows mutation XSS via a parse and serialize round-trip of attacker-supplied HTML.
This issue affects lazy_html: from 0.1.0 before 0.1.13. ImpactAn attacker who can submit HTML to an application that sanitizes it with lazy_html can run script in the browsers of users who view the sanitized output. Affected versions
0.1.0
0.1.1
0.1.10
0.1.11
0.1.12
0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
+ 1 more Show less
0.1.9
Fixed in
0.1.13
References
Updated Sep 25, 2026 · Source: OSV.dev |