CVE-2026-5160

Description

Versions of the package github.com/yuin/goldmark/renderer/html before 1.7.17 are vulnerable to Cross-site Scripting (XSS) due to improper ordering of URL validation and normalization. The renderer validates link destinations using a prefix-based check (IsDangerousURL) before resolving HTML entities. This allows an attacker to bypass protocol filtering by encoding dangerous schemes using HTML5 named character references. For example, a payload such as javascript:alert(1) is not recognized as dangerous during validation, leading to arbitrary script execution in the context of applications that render the URL.

How to fix CVE-2026-5160

To remediate CVE-2026-5160, upgrade the affected package to a fixed version below.

• —no fix listed
• —upgrade to 1.7.17 or later

Is CVE-2026-5160 being exploited?

Low — EPSS is 0.1%, meaning exploitation activity has not been observed at scale.

Affected packages (2)

• from 0
• from 0, < 1.7.17

CVSS scores

References (5)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2026-5160
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2026-5160
• PATCHgithub.com/yuin/goldmark
• WEBgithub.com/yuin/goldmark/commit/cb46bbc4eca29d55aa9721e04ad207c23ccc44f9