CVE-2026-27136

MEDIUM6.1EPSS 0.03%

Invoking duplicate attributes can cause XSS in golang.org/x/net/html

Published: 5/22/2026Modified: 6/3/2026

Also known as:DEBIAN-CVE-2026-27136

Description

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Affected packages (2)

Debian/golang-golang-x-netfrom 0
Go/golang.org/x/netfrom 0, < 0.55.0

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	MEDIUM6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References (4)

ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2026-27136
PATCHhttps://go.dev/cl/781685
REPORThttps://go.dev/issue/79575
WEBhttps://groups.google.com/g/golang-announce/c/iI-mYSI0lu8