VDB
RHSA-2026:54285
RHSA-2026:54285
PUBLISHED
CVSS 8.199999809265137 HIGH
A flaw was found in golang.org/x/net/html. A remote attacker could exploit this vulnerability by providing specially crafted HTML. When this arbitrary HTML is parsed and rendered, it can result in an unexpected HTML tree, bypassing input sanitization. This can be leveraged to execute Cross-Site Scripting (XSS) attacks, potentially leading to arbitrary code execution in applications that use the affected component.
Risk Scores
CVSS 3.1
8.199999809265137
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat OpenShift Workload Availability Operator | |
| Red Hat | registry.redhat.io/workload-availability/machine-deletion-remediation-rhel9-operator@sha256:60f6304080ea8c80b00150595f771a050918789b3d8458db355d656b62891d68_arm64 as a component of Red Hat OpenShift Workload Availability 0.7 | * |
| Red Hat | registry.redhat.io/workload-availability/machine-deletion-remediation-operator-bundle@sha256:d3ef7d11ec2b62962e8d582587d19dc3295f8265d9bf0b0975742c5d6d810e3d_amd64 as a component of Red Hat OpenShift Workload Availability 0.7 | * |
| Red Hat | registry.redhat.io/workload-availability/machine-deletion-remediation-rhel9-operator@sha256:2a0dccb5cc796fe6d02a28571233b584576e2b5874ee958a161d06f0c74d8f99_s390x as a component of Red Hat OpenShift Workload Availability 0.7 | * |
| Red Hat | golang.org/x/net | |
| golang.org/x/net/html | ||
| Red Hat | registry.redhat.io/workload-availability/machine-deletion-remediation-rhel9-operator@sha256:d2c6bf317539bb5cfae5ecf1467edcccad32f27edfa7f9fbd57314e20ecb23d7_ppc64le as a component of Red Hat OpenShift Workload Availability 0.7 | * |
| Red Hat | registry.redhat.io/workload-availability/machine-deletion-remediation-rhel9-operator@sha256:66d3d2c1e0074ed2c9a03024a534173208adc3ab615f0b19f12296c1faf2b4aa_amd64 as a component of Red Hat OpenShift Workload Availability 0.7 | * |
Timeline
- Aug 12, 2026 CVE Published
- Sep 30, 2026 CVE Updated
- Sep 30, 2026 Distribution Patch
- Sep 30, 2026 Distribution Patch
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:54285 advisory
- https://access.redhat.com/security/cve/CVE-2026-25681 advisory
- https://access.redhat.com/security/cve/CVE-2026-27136 advisory
- https://access.redhat.com/security/cve/CVE-2026-33811 advisory
- https://access.redhat.com/security/cve/CVE-2026-33814 advisory
- https://access.redhat.com/security/cve/CVE-2026-39820 advisory
- https://access.redhat.com/security/cve/CVE-2026-39821 advisory
- https://access.redhat.com/security/cve/CVE-2026-42499 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54285.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2480761 issue
- https://www.cve.org/CVERecord?id=CVE-2026-25681 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-25681 advisory
- https://go.dev/cl/781703 advisory
- https://go.dev/issue/79574 advisory
- https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8 advisory
- https://pkg.go.dev/vuln/GO-2026-5029 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2480757 issue
- https://www.cve.org/CVERecord?id=CVE-2026-27136 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-27136 advisory
…and 35 more