CVE-2026-42502

MEDIUM6.1EPSS 0.03%

Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html

Published: 5/22/2026Modified: 6/3/2026

Also known as:DEBIAN-CVE-2026-42502

Description

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Affected packages (2)

Debian/golang-golang-x-netfrom 0
Go/golang.org/x/netfrom 0, < 0.55.0

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	MEDIUM6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References (4)

ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2026-42502
PATCHhttps://go.dev/cl/781701
REPORThttps://go.dev/issue/79572
WEBhttps://groups.google.com/g/golang-announce/c/iI-mYSI0lu8