HtmlUnit vulnerabilities
We track 4 vulnerabilities in HtmlUnit products across 2 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on October 15, 2026.
Latest HtmlUnit vulnerabilities
- 7.2 High severity
htmlunit-neko: Improper Neutralization of Input During Web Page Generation
HtmlUnit Neko is an HtmlUnit adaptation of NekoHTML. Prior to 5.4.0, HTMLWriterFilter writes decoded TEXTAREA and TITLE character content without entity encoding because both elements are treated as special content. During a parse-and-serialize round trip, ent
- 8.8 High severity
htmlunit: Improper Control of Generation of Code
HtmlUnit is a GUI-less browser for Java programs. HtmlUnit is vulnerable to Remote Code Execution (RCE) via XSTL, when browsing the attacker’s webpage. This vulnerability has been patched in version 3.9.0
- 7.5 High severity
Htmlunit: Out-of-bounds Write
Those using HtmlUnit to browse untrusted webpages may be vulnerable to Denial of service attacks (DoS). If HtmlUnit is running on user supplied web pages, an attacker may supply content that causes HtmlUnit to crash by a stack overflow. This effect may support
- 9.8 Critical severity
net.sourceforge.htmlunit:htmlunit: Improper Control of Generation of Code
Versions of the package net.sourceforge.htmlunit:htmlunit from 0 and before 3.0.0 are vulnerable to Remote Code Execution (RCE) via XSTL, when browsing the attacker’s webpage.