GO-2026-5029

Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html

At a glance

Published: 2026-05-22 02:46 UTC
Updated: 2026-09-22 10:41 UTC
CVE: CVE-2026-25681

Description

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Affected packages

Package	Versions
Go · golang.org/x/net	introduced 0, fixed 0.55.0

References

https://go.dev/issue/79574 REPORT
https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8 WEB
https://go.dev/cl/781703 FIX

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — Go Vulnerability Database