Packages

lazy_html

0.1.14

0.1.14 0.1.13 0.1.12 0.1.11 0.1.10 0.1.9 0.1.8 0.1.7 0.1.6 0.1.5 0.1.4 0.1.3 0.1.2 0.1.1 0.1.0

Efficient parsing and querying of HTML documents

HexDocs Report package

Current section

1 Advisory

Jump to

Documentation 15 Versions 3 Dependencies 23 Dependants 1 Advisory Files Activity

EEF-CVE-2026-92106 CVE-2026-92106 GHSA-8rqp-v692-v82q

lazy_html serializes SVG and MathML style and script text unescaped, allowing mutation XSS

September 25, 2026

CVSS

2.3 / 10.0 Low

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Affected Versions

>= 0.1.0 and < 0.1.13

References

https://cna.erlef.org/cves/CVE-2026-92106.html
https://github.com/dashbitco/lazy_html/commit/1dee15746c024916b3110af8b168c2f3b3065fbd
https://github.com/dashbitco/lazy_html/commit/f32c7fd6223225b68bc8691c78b6d4a77972f1d5
https://github.com/dashbitco/lazy_html/security/advisories/GHSA-8rqp-v692-v82q
https://hex.pm/packages/lazy_html

Checksum

Dependency Config

mix.exs

rebar.config

Gleam

erlang.mk

Package Details

Downloads Last 30 days, all versions

this version

47 986

yesterday

40 163

last 7 days

235 201

all time

4 542 046

Last Updated

Nov 03, 2026

License

Apache-2.0

Build Tools

mix make

Publisher

jonatanklosko

Owners

dashbit

Operator	Description	Example
name:	Match package name. Supports * wildcards and repo/package form	name:phx* or name:hexpm/phoenix
description:	Full-text search of package descriptions	description:auth
depends:	Packages depending on a given package. Supports repo:package form	depends:ecto or depends:hexpm:ecto
build_tool:	Filter by build tool	build_tool:mix
updated_after:	Packages updated after an ISO8601 datetime	updated_after:2025-01-01T00:00:00Z
extra:	Match custom metadata (key,value). Nested keys are separated by commas	extra:license,MIT

lazy_html

Checksum

Dependency Config

Package Details

Links

Owners

Search filters