CVE-2026-42506
Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html
At a glance
- Severity
- MEDIUM 6.1
- EPSS
- EPSS 0.24 % · percentile 14 (2026-10-27)
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Go
- NVD status
- Analyzed
Description
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N | CISA-ADP |
| CVSS 3.1 | MEDIUM 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
Weaknesses (CWE)
Advisories
- GO-2026-5025 — Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html
European references
- ENISA EUVD · EUVD-2026-31446
- GCVE · GCVE-0-2026-42506
CERT-FR advisories
- CERTFR-2026-AVI-1385 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1281 — Multiples vulnérabilités dans les produits Splunk · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0958 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0901 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0810 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0788 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:golang:net:*:*:*:*:*:go:*:*< 0.55.0
Affected products
| Product | Versions |
|---|---|
| golang.org/x/net · golang.org/x/net/html | affected 0 < 0.55.0 |
References
- https://go.dev/issue/79571
- https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8
- https://go.dev/cl/781700
- https://pkg.go.dev/vuln/GO-2026-5025
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |