Skip to content
CVE PROGRAM SOURCE RECORD6.1 Medium

CVE-2026-42506

Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Go

Description

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

golang.org/x/net golang.org/x/net/html

Default version status: unaffected

  • 0 to < 0.55.0affected

References