CVE-2026-42506

MediumCVSS 6.1/10Last modified Jul 23, 2026

Description

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: May 22, 2026
Last modified: Jul 23, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-425075.3When returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker to CVE-2026-425089.1Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' CVE-2026-425096.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Wicket. This issue affects Apa CVE-2026-42512.5A vulnerability was determined in CityData CityChat up to 0.12.6 on Android. Affected by this vulnerability is an unknown functionality of t CVE-2026-425107.2OpenStack Ironic before 35.0.1 allows ipmitool execution in a non-default configuration that has a console interface.CVE-2026-425118.1The BOOTP file field is written to the lease file without escaping embedded double-quotes, allowing injection of arbitrary dhclient.conf dir CVE-2026-425128.1As dhclient is building an environment to pass to dhclient-script, it may need to resize the array of string pointers. The code which expan CVE-2026-425138.8This vulnerability exists in e-Sushrut due to improper authentication logic that relies on client-side response parameters to determine auth CVE-2026-425148.8This vulnerability exists in e-Sushrut due to exposure of OTPs in plaintext within API responses. A remote attacker could exploit this vulne CVE-2026-425157.1This vulnerability exists in e-Sushrut due to improper access control in resource access validation. An authenticated attacker could exploit CVE-2026-425167.1This vulnerability exists in e-Sushrut due to improper authorization checks during resource access. An authenticated attacker could exploit CVE-2026-425177.1This vulnerability exists in e-Sushrut due to the use of reversible Base64 encoding for protecting sensitive data. An authenticated attacker