VDB
RHSA-2026:51084
RHSA-2026:51084
PUBLISHED
CVSS 8.800000190734863 HIGH
Record from redhat · Published August 6, 2026
A flaw was found in golang.org/x/net/html. A remote attacker could exploit this vulnerability by providing specially crafted HTML. When this arbitrary HTML is parsed and rendered, it can result in an unexpected HTML tree, bypassing input sanitization. This can be leveraged to execute Cross-Site Scripting (XSS) attacks, potentially leading to arbitrary code execution in applications that use the affected component.
Risk scores
CVSS 3.1
8.800000190734863
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/rhtas/policy-controller-rhel9-operator@sha256:f2fbc563cd7a9f63dbf516265cda7a9a855682856fa799b831ee6e12b7d6332d_amd64 as a component of Red Hat Trusted Artifact Signer 1.4 | * |
| Red Hat | registry.redhat.io/rhtas/policy-controller-operator-bundle@sha256:b5c08c17bd9c60a295f9e557371da76d5bad9e87071c478e4caef82fefc375fd_amd64 as a component of Red Hat Trusted Artifact Signer 1.4 | * |
Timeline
- Aug 6, 2026 CVE Published
- Sep 30, 2026 CVE Updated
- Sep 30, 2026 Distribution Patch (2 in total, the first dated here)
- Sep 30, 2026 Security Advisory (3 in total, the first dated here)
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln RHSA-2026:51084
vulnetix vdb fixes RHSA-2026:51084Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/RHSA-2026%3A51084/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- https://access.redhat.com/errata/RHSA-2026:51084 advisory
- https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4 advisory
- https://access.redhat.com/security/cve/CVE-2026-25681 advisory
- https://access.redhat.com/security/cve/CVE-2026-53488 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_51084.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2480761 issue
- https://www.cve.org/CVERecord?id=CVE-2026-25681 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-25681 advisory
- https://go.dev/cl/781703 advisory
- https://go.dev/issue/79574 advisory
- https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8 advisory
- https://pkg.go.dev/vuln/GO-2026-5029 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2495815 issue
- https://www.cve.org/CVERecord?id=CVE-2026-53488 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-53488 advisory
- https://github.com/containerd/containerd/security/advisories/GHSA-xhf5-7wjv-pqxp advisory