VDB
RHSA-2026:54284
RHSA-2026:54284
PUBLISHED
CVSS 8.199999809265137 HIGH
A flaw was found in golang.org/x/net/html. A remote attacker could exploit this vulnerability by providing specially crafted HTML. When this arbitrary HTML is parsed and rendered, it can result in an unexpected HTML tree, bypassing input sanitization. This can be leveraged to execute Cross-Site Scripting (XSS) attacks, potentially leading to arbitrary code execution in applications that use the affected component.
Risk Scores
CVSS 3.1
8.199999809265137
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/workload-availability/self-node-remediation-rhel9-operator@sha256:07593c5d721545ec74310851bdeb5eb050336273a1164fc452fbc526edd4f5b0_amd64 as a component of Red Hat OpenShift Workload Availability 0.13 | * |
| Red Hat | registry.redhat.io/workload-availability/self-node-remediation-rhel9-operator@sha256:705512633725cde8afe513597b30acee051db00bf510475b70cf9f312a2a85e7_arm64 as a component of Red Hat OpenShift Workload Availability 0.13 | * |
| Red Hat | registry.redhat.io/workload-availability/self-node-remediation-rhel9-operator@sha256:117992cdf46fc18f6d50b2fde0d8bdf6b711642242c3c37cca6f548e88f3805d_s390x as a component of Red Hat OpenShift Workload Availability 0.13 | * |
| Red Hat | registry.redhat.io/workload-availability/self-node-remediation-rhel9-operator@sha256:87b7964f08cad9e9e475a2f095c85d08894bcc4fc20203924bcaa933385b34cf_ppc64le as a component of Red Hat OpenShift Workload Availability 0.13 | * |
| Red Hat | registry.redhat.io/workload-availability/self-node-remediation-operator-bundle@sha256:b6ff2ce15359c7ccda7f9fdfa5500d7f01ce240ae9701de5625c31899872ca99_amd64 as a component of Red Hat OpenShift Workload Availability 0.13 | * |
Timeline
- Aug 12, 2026 CVE Published
- Sep 30, 2026 CVE Updated
- Sep 30, 2026 Distribution Patch
- Sep 30, 2026 Distribution Patch
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:54284 advisory
- https://access.redhat.com/security/cve/CVE-2026-25681 advisory
- https://access.redhat.com/security/cve/CVE-2026-27136 advisory
- https://access.redhat.com/security/cve/CVE-2026-33811 advisory
- https://access.redhat.com/security/cve/CVE-2026-33814 advisory
- https://access.redhat.com/security/cve/CVE-2026-39820 advisory
- https://access.redhat.com/security/cve/CVE-2026-39821 advisory
- https://access.redhat.com/security/cve/CVE-2026-42499 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54284.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2480761 issue
- https://www.cve.org/CVERecord?id=CVE-2026-25681 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-25681 advisory
- https://go.dev/cl/781703 advisory
- https://go.dev/issue/79574 advisory
- https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8 advisory
- https://pkg.go.dev/vuln/GO-2026-5029 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2480757 issue
- https://www.cve.org/CVERecord?id=CVE-2026-27136 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-27136 advisory
…and 35 more