GO-2026-5025

Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html

En bref

Publiée: 2026-05-22 02:46 UTC
Mise à jour: 2026-05-30 05:14 UTC
CVE: CVE-2026-42506

Description

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Paquets affectés

Paquet	Versions
Go · golang.org/x/net	introduced 0, fixed 0.55.0

Références

https://go.dev/issue/79571 REPORT
https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8 WEB
https://go.dev/cl/781700 FIX

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — Go Vulnerability Database