Vulnerability Description
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
CVSS Score
6.1
MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Golang | Net | < 0.55.0 |
Related Weaknesses (CWE)
References
- https://go.dev/cl/781703Issue Tracking
- https://go.dev/issue/79574Issue Tracking
- https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8Mailing List
- https://pkg.go.dev/vuln/GO-2026-5029Vendor Advisory
FAQ
What is CVE-2026-25681?
CVE-2026-25681 is a vulnerability with a CVSS score of 6.1 (MEDIUM). Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML befor...
How severe is CVE-2026-25681?
CVE-2026-25681 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-25681?
Check the references section above for vendor advisories and patch information. Affected products include: Golang Net.