Vulnerability Description
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
CVSS Score
6.1
MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Golang | Net | < 0.55.0 |
Related Weaknesses (CWE)
References
- https://go.dev/cl/781685Issue Tracking
- https://go.dev/issue/79575Issue Tracking
- https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8Mailing List
- https://pkg.go.dev/vuln/GO-2026-5030Vendor Advisory
FAQ
What is CVE-2026-27136?
CVE-2026-27136 is a vulnerability with a CVSS score of 6.1 (MEDIUM). Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML befor...
How severe is CVE-2026-27136?
CVE-2026-27136 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-27136?
Check the references section above for vendor advisories and patch information. Affected products include: Golang Net.