Vulnerability Description
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
CVSS Score
6.1
MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Golang | Net | < 0.55.0 |
Related Weaknesses (CWE)
References
- https://go.dev/cl/781701Issue Tracking
- https://go.dev/issue/79572Issue Tracking
- https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8Mailing List
- https://pkg.go.dev/vuln/GO-2026-5027Vendor Advisory
FAQ
What is CVE-2026-42502?
CVE-2026-42502 is a vulnerability with a CVSS score of 6.1 (MEDIUM). Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML befor...
How severe is CVE-2026-42502?
CVE-2026-42502 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-42502?
Check the references section above for vendor advisories and patch information. Affected products include: Golang Net.