VDB
RHSA-2026:52910
RHSA-2026:52910
PUBLISHED
CVSS 7.400000095367432 HIGH
A flaw was found in golang.org/x/net/html. A remote attacker could exploit this vulnerability by providing specially crafted HTML. When this arbitrary HTML is parsed and rendered, it can result in an unexpected HTML tree, bypassing input sanitization. This can be leveraged to execute Cross-Site Scripting (XSS) attacks, potentially leading to arbitrary code execution in applications that use the affected component.
Risk Scores
CVSS 3.1
7.400000095367432
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/openshift-gitops-1/must-gather-rhel9@sha256:4366d257d7471fe5ab3f4506b2878c70c221da4dceed21e175349d067afa15c1_amd64 as a component of Red Hat OpenShift GitOps 1.2 | * |
| Red Hat | registry.redhat.io/openshift-gitops-1/gitops-rhel9@sha256:f35fcd4671bf5125ac85f2df7c0ff0b08180878befdc68b65e3f3b12cd6bf306_amd64 as a component of Red Hat OpenShift GitOps 1.20 | * |
| Red Hat | registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel9@sha256:00ab3f1c310b9d271fcd443b55ac584b16eed918110248ca93ea70f31f920dd3_s390x as a component of Red Hat OpenShift GitOps 1.20 | * |
| Red Hat | registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:8a1dd18f2ff4b02cc9510e3585b6fc01744f55ede6842a8467b9f3dbe8f3bcba_amd64 as a component of Red Hat OpenShift GitOps 1.2 | * |
| Red Hat | registry.redhat.io/openshift-gitops-1/gitops-rhel9@sha256:995d12c0d3b8d8bfe68483b4f620a426b8e02a20da53b8b71b5f4e0fa2f9df52_arm64 as a component of Red Hat OpenShift GitOps 1.20 | * |
| Red Hat | registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:fc68588a2cf7c68f11f5381530c9046ee96ed7ff40f0458110df21882b7e3666_s390x as a component of Red Hat OpenShift GitOps 1.2 | * |
| Red Hat | registry.redhat.io/openshift-gitops-1/must-gather-rhel9@sha256:4366d257d7471fe5ab3f4506b2878c70c221da4dceed21e175349d067afa15c1_amd64 as a component of Red Hat OpenShift GitOps 1.20 | * |
| Red Hat | registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:42b3a7e88b81bce3445885d6005305728495a67ae9f01ce3ce83094706f61d67_ppc64le as a component of Red Hat OpenShift GitOps 1.20 | * |
| Red Hat | registry.redhat.io/openshift-gitops-1/gitops-operator-bundle@sha256:0aea43abfd0702c07cf70541bc46fe742b0742c9f43641134e2163eaca8f4b5c_amd64 as a component of Red Hat OpenShift GitOps 1.2 | * |
| Red Hat | registry.redhat.io/openshift-gitops-1/dex-rhel9@sha256:6deca0a6dc84212f857860f578609615be187789a807d75c14adcaf29a9477bc_ppc64le as a component of Red Hat OpenShift GitOps 1.20 | * |
| Red Hat | registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:5e5c98b183a483d24356930e6ed8561f6c1731e9cb495021c1be080554cfdd54_arm64 as a component of Red Hat OpenShift GitOps 1.2 | * |
| Red Hat | registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:857c25929f02dcdb5efdfca6a44270aa59279ee00fc0d1e844ffcaed9494e5ff_amd64 as a component of Red Hat OpenShift GitOps 1.2 | * |
| Red Hat | registry.redhat.io/openshift-gitops-1/console-plugin-rhel9@sha256:42b3a7e88b81bce3445885d6005305728495a67ae9f01ce3ce83094706f61d67_ppc64le as a component of Red Hat OpenShift GitOps 1.2 | * |
| Red Hat | registry.redhat.io/openshift-gitops-1/argocd-rhel9@sha256:f538166c509e824680dae0beae52f3fb2952da9ced6e57a365f49f7f4ca1ee0e_ppc64le as a component of Red Hat OpenShift GitOps 1.20 | * |
| Red Hat | registry.redhat.io/openshift-gitops-1/must-gather-rhel9@sha256:5bf0e50521517aefd23cde290536bb13db3f5987fec79246d9127e1fc41c76f9_arm64 as a component of Red Hat OpenShift GitOps 1.2 | * |
| Red Hat | registry.redhat.io/openshift-gitops-1/argocd-agent-rhel9@sha256:559599a66ad79ac5cd0f45fcc36535cc5a44e294dc7f19a389ac1a85842c15f3_s390x as a component of Red Hat OpenShift GitOps 1.2 | * |
| Red Hat | registry.redhat.io/openshift-gitops-1/gitops-rhel9@sha256:f35fcd4671bf5125ac85f2df7c0ff0b08180878befdc68b65e3f3b12cd6bf306_amd64 as a component of Red Hat OpenShift GitOps 1.2 | * |
| Red Hat | registry.redhat.io/openshift-gitops-1/gitops-rhel9@sha256:617c5f48ae2c254071034ac37f275e4ad7177c4239c8039c67721c5900102a7c_s390x as a component of Red Hat OpenShift GitOps 1.20 | * |
| Red Hat | registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:1a0fa9305c51cc018e30db541f7d9eae8a7149f9ad1fe54de3f1fa13b5a31c07_amd64 as a component of Red Hat OpenShift GitOps 1.20 | * |
| Red Hat | registry.redhat.io/openshift-gitops-1/argocd-extensions-rhel9@sha256:1a0fa9305c51cc018e30db541f7d9eae8a7149f9ad1fe54de3f1fa13b5a31c07_amd64 as a component of Red Hat OpenShift GitOps 1.2 | * |
…and 62 more
Timeline
- Aug 10, 2026 CVE Published
- Sep 30, 2026 CVE Updated
- Sep 30, 2026 Distribution Patch
- Sep 30, 2026 Distribution Patch
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:52910 advisory
- https://access.redhat.com/security/cve/CVE-2026-25681 advisory
- https://access.redhat.com/security/cve/CVE-2026-27136 advisory
- https://access.redhat.com/security/cve/CVE-2026-39828 advisory
- https://access.redhat.com/security/cve/CVE-2026-39829 advisory
- https://access.redhat.com/security/cve/CVE-2026-39830 advisory
- https://access.redhat.com/security/cve/CVE-2026-39831 advisory
- https://access.redhat.com/security/cve/CVE-2026-39832 advisory
- https://access.redhat.com/security/cve/CVE-2026-39835 advisory
- https://access.redhat.com/security/cve/CVE-2026-42508 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://docs.redhat.com/en/documentation/red_hat_openshift_gitops/1.20/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_52910.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2480761 issue
- https://www.cve.org/CVERecord?id=CVE-2026-25681 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-25681 advisory
- https://go.dev/cl/781703 advisory
- https://go.dev/issue/79574 advisory
- https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8 advisory
- https://pkg.go.dev/vuln/GO-2026-5029 advisory
…and 51 more