GO-2026-5029

vendorUSosv

Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html

view advisory published 2026-05-22Licence: per source

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-25681US	—	0.22% (13th)	—	2026-05-22
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanit…

references

External citations — patches, advisories, analysis.

https://go.dev/cl/781703FIX
https://go.dev/issue/79574REPORT
https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan