CVE-2026-25681

MediumCVSS 6.1/10Last modified Jul 23, 2026

Description

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-1021

Affected software

Vendor	Product	Versions
golang.org/x/net	golang.org/x/net/html	< 0.55.0

References

https://go.dev/cl/781703Issue Tracking
https://go.dev/issue/79574Issue Tracking
https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8Mailing List
https://pkg.go.dev/vuln/GO-2026-5029Vendor Advisory

Timeline

Published: May 22, 2026
Last modified: Jul 23, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-256844.4A file type attribution issue in Zscaler Internet Access File Type Control evaluation rules may allow improper evaluation of File Type Contr CVE-2026-256878.1A race condition in the ZPA tunnel handler of affected versions of Zscaler Client Connector (ZCC) allows a heap corruption, resulting in a d CVE-2026-256886.1Improper Neutralization of Alternate XSS Syntax vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. AI-genera CVE-2026-256896.5An improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiDeceptor 6.2.0, FortiDe CVE-2026-25696.4The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via P CVE-2026-256906.5An improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiDeceptor 6.0.0 through CVE-2026-256916.7A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5,CVE-2026-256996.1Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Apache Answer. This issue affects Apache Answer: through CVE-2026-257007.2Improper Restriction of Security Token Assignment vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. Previou CVE-2026-257017.0An Insecure Temporary File vulnerability in openSUSE sdbootutil allows local users to pre-create a directory to achieve various effects like CVE-2026-257029.8A Improper Access Control vulnerability in the kernel of SUSE SUSE Linux Enterprise Server 12 SP5 breaks nftables, causing firewall rules ap CVE-2026-257037.3NeuVector through 5.4.9 is can potentially leak information from manager /network/graph API due to missing authentication and cached data co