VDB
RHSA-2026:54286
RHSA-2026:54286
PUBLISHED
CVSS 8.800000190734863 HIGH
A flaw was found in golang.org/x/net/html. A remote attacker could exploit this vulnerability by providing specially crafted HTML. When this arbitrary HTML is parsed and rendered, it can result in an unexpected HTML tree, bypassing input sanitization. This can be leveraged to execute Cross-Site Scripting (XSS) attacks, potentially leading to arbitrary code execution in applications that use the affected component.
Risk Scores
CVSS 3.1
8.800000190734863
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/workload-availability/storage-based-remediation-agent-rhel9@sha256:cf75a72c8b4ec1972529dd273879f989e40e12a05cdf6b04c23997c0940531c4_amd64 as a component of Red Hat OpenShift Workload Availability 0.3 | * |
| Red Hat | registry.redhat.io/workload-availability/storage-based-remediation-rhel9-operator@sha256:7e1b666f19ef988fcfd97bbcee482c6494bf91ca712a0893027ac4f66da9111e_ppc64le as a component of Red Hat OpenShift Workload Availability 0.3 | * |
| Red Hat | registry.redhat.io/workload-availability/storage-based-remediation-agent-rhel9@sha256:615742b426e6685458a74d1d70542c2b6cacbddbc54579c57ea8722723214144_s390x as a component of Red Hat OpenShift Workload Availability 0.3 | * |
| Red Hat | registry.redhat.io/workload-availability/storage-based-remediation-agent-rhel9@sha256:a135778609e2e6724cf2acdd147d42a4d42f098d6a02b383210705294e396e6f_arm64 as a component of Red Hat OpenShift Workload Availability 0.3 | * |
| Red Hat | registry.redhat.io/workload-availability/storage-based-remediation-rhel9-operator@sha256:50d682d3dcefeedb5d197bd9cabad1cab8e70b01312c91f74de039f0da823d07_amd64 as a component of Red Hat OpenShift Workload Availability 0.3 | * |
| Red Hat | registry.redhat.io/workload-availability/storage-based-remediation-agent-rhel9@sha256:ddccb1cd4cb2c76339790ea62da7b131be252b5cbc43c9f099c18f11680d7a36_ppc64le as a component of Red Hat OpenShift Workload Availability 0.3 | * |
| Red Hat | registry.redhat.io/workload-availability/storage-based-remediation-rhel9-operator@sha256:3721ffeb4a0ee48d815c562d21905d395fe72c3c0db0902a842f8da1d3dd4611_arm64 as a component of Red Hat OpenShift Workload Availability 0.3 | * |
| Red Hat | registry.redhat.io/workload-availability/storage-based-remediation-operator-bundle@sha256:264d76e41258bd9c6b9b9b166a2201270953032f05f72cd53243d80b5297e8a4_amd64 as a component of Red Hat OpenShift Workload Availability 0.3 | * |
| Red Hat | registry.redhat.io/workload-availability/storage-based-remediation-rhel9-operator@sha256:6928d66e8b19b71eacacfb755f73f4f8e349c086f9828d33508aa34eccc92394_s390x as a component of Red Hat OpenShift Workload Availability 0.3 | * |
Timeline
- Aug 12, 2026 CVE Published
- Sep 30, 2026 CVE Updated
- Sep 30, 2026 Distribution Patch
- Sep 30, 2026 Distribution Patch
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
References
- https://access.redhat.com/security/cve/CVE-2026-33814 advisory
- https://access.redhat.com/security/cve/CVE-2026-39820 advisory
- https://access.redhat.com/security/cve/CVE-2026-39821 advisory
- https://access.redhat.com/security/cve/CVE-2026-39883 advisory
- https://access.redhat.com/security/cve/CVE-2026-42499 advisory
- https://access.redhat.com/security/cve/CVE-2026-33811 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2480761 issue
- https://www.cve.org/CVERecord?id=CVE-2026-25681 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-25681 advisory
- https://go.dev/cl/781703 advisory
- https://go.dev/issue/79574 advisory
- https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8 advisory
- https://pkg.go.dev/vuln/GO-2026-5029 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2480757 issue
- https://www.cve.org/CVERecord?id=CVE-2026-27136 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-27136 advisory
- https://go.dev/cl/781685 advisory
- https://go.dev/issue/79575 advisory
- https://pkg.go.dev/vuln/GO-2026-5030 advisory
…and 46 more