6.1
Medium
CVE-2026-42502 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree
Description
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| golang.org/x/net/html 0.55 | earliest → < 0.55.0 | 0.55.0 |
References
- go.dev go.dev
- groups.google.com groups.google.com
- go.dev go.dev
- pkg.go.dev pkg.go.dev
Timeline
- Published
- Last modified
Other CVEs of golang.org/x/net/html
The 12 CVEs of golang.org/x/net/html →
CVE-2026-78661
Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net
7.5
High
CVE-2026-97045
Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net
6.1
Medium
CVE-2026-27136
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree
6.1
Medium
CVE-2026-25680
Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service
6.5
Medium