CVE-2026-25681

MEDIUM6.1EPSS 0.03%

Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html

Published: 5/22/2026Modified: 6/3/2026

Also known as:DEBIAN-CVE-2026-25681

Description

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Affected packages (2)

Debian/golang-golang-x-netfrom 0
Go/golang.org/x/netfrom 0, < 0.55.0

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	MEDIUM6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References (4)

ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2026-25681
PATCHhttps://go.dev/cl/781703
REPORThttps://go.dev/issue/79574
WEBhttps://groups.google.com/g/golang-announce/c/iI-mYSI0lu8