ANCHORE-2026-42502

ANCHORE-2026-42502 PUBLISHED

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Affected Products

Vendor	Product	Versions
golang.org/x/net	golang.org/x/net/html	0, 0, 0

Timeline

May 22, 2026 CVE Published
May 22, 2026 CVE Updated

References

https://go.dev/issue/79572 url
https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8 url
https://go.dev/cl/781701 url
https://pkg.go.dev/vuln/GO-2026-5027 url

Open in Interactive Console →