6.1
Moyenne
CVE-2026-25681 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree
Description
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| golang.org/x/net/html 0.55 | premières → < 0.55.0 | 0.55.0 |
Références
- go.dev go.dev
- groups.google.com groups.google.com
- go.dev go.dev
- pkg.go.dev pkg.go.dev
Chronologie
- Publiée
- Dernière modification
Autres CVE de golang.org/x/net/html
Les 12 CVE de golang.org/x/net/html →
CVE-2026-78661
Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net
7.5
Élevée
CVE-2026-97045
Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net
6.1
Moyenne
CVE-2026-27136
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree
6.1
Moyenne
CVE-2026-42502
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree
6.1
Moyenne