VDB
RHSA-2026:54274
RHSA-2026:54274
PUBLISHED
CVSS 8.800000190734863 HIGH
A flaw was found in golang.org/x/net/html. A remote attacker could exploit this vulnerability by providing specially crafted HTML. When this arbitrary HTML is parsed and rendered, it can result in an unexpected HTML tree, bypassing input sanitization. This can be leveraged to execute Cross-Site Scripting (XSS) attacks, potentially leading to arbitrary code execution in applications that use the affected component.
Risk Scores
CVSS 3.1
8.800000190734863
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/workload-availability/fence-agents-remediation-rhel9-operator@sha256:0e14357c479ca1da780332572ed85f541c5788fde4023358fc67582a442b7323_ppc64le as a component of Red Hat OpenShift Workload Availability 0.8 | * |
| Red Hat | registry.redhat.io/workload-availability/fence-agents-remediation-rhel9-operator@sha256:5b3a2a1711dd9c7659308766f28cc8897a8076e0fd729fdf5696395277b6a76b_amd64 as a component of Red Hat OpenShift Workload Availability 0.8 | * |
| Red Hat | registry.redhat.io/workload-availability/fence-agents-remediation-rhel9-operator@sha256:402c93a3cd63e51b3fcadc4bf2491f73063fc15b1332a2475c23511b12416f00_s390x as a component of Red Hat OpenShift Workload Availability 0.8 | * |
| Red Hat | registry.redhat.io/workload-availability/fence-agents-remediation-operator-bundle@sha256:f722fd012aa6bad3c185baa5644bb8087745e04d37a34b925a38575941cff096_amd64 as a component of Red Hat OpenShift Workload Availability 0.8 | * |
| Red Hat | registry.redhat.io/workload-availability/fence-agents-remediation-rhel9-operator@sha256:b9a555cb95c6a341759fee277a815c863c3f66d6a611984f9007434698e5ff58_arm64 as a component of Red Hat OpenShift Workload Availability 0.8 | * |
Timeline
- Aug 12, 2026 CVE Published
- Sep 30, 2026 CVE Updated
- Sep 30, 2026 Distribution Patch
- Sep 30, 2026 Distribution Patch
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:54274 advisory
- https://access.redhat.com/security/cve/CVE-2026-25681 advisory
- https://access.redhat.com/security/cve/CVE-2026-27136 advisory
- https://access.redhat.com/security/cve/CVE-2026-33186 advisory
- https://access.redhat.com/security/cve/CVE-2026-33811 advisory
- https://access.redhat.com/security/cve/CVE-2026-33814 advisory
- https://access.redhat.com/security/cve/CVE-2026-39820 advisory
- https://access.redhat.com/security/cve/CVE-2026-39821 advisory
- https://access.redhat.com/security/cve/CVE-2026-39883 advisory
- https://access.redhat.com/security/cve/CVE-2026-42499 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54274.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2480761 issue
- https://www.cve.org/CVERecord?id=CVE-2026-25681 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-25681 advisory
- https://go.dev/cl/781703 advisory
- https://go.dev/issue/79574 advisory
- https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8 advisory
- https://pkg.go.dev/vuln/GO-2026-5029 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2480757 issue
…and 46 more