VDB
RHSA-2026:54287
RHSA-2026:54287
PUBLISHED
CVSS 8.199999809265137 HIGH
A flaw was found in golang.org/x/net/html. A remote attacker could exploit this vulnerability by providing specially crafted HTML. When this arbitrary HTML is parsed and rendered, it can result in an unexpected HTML tree, bypassing input sanitization. This can be leveraged to execute Cross-Site Scripting (XSS) attacks, potentially leading to arbitrary code execution in applications that use the affected component.
Risk Scores
CVSS 3.1
8.199999809265137
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/workload-availability/node-remediation-console-rhel9@sha256:5e0f6c04a44a3050869c00524f214bfd72ca34aadbf71b80f0d12cc3022d4f2b_ppc64le as a component of Red Hat OpenShift Workload Availability 0.12 | * |
| Red Hat | registry.redhat.io/workload-availability/node-healthcheck-rhel9-operator@sha256:6ece0ac34989350e9be7613fc533767af9ad7bf9544bad6ad297dcece2b6ca64_amd64 as a component of Red Hat OpenShift Workload Availability 0.12 | * |
| Red Hat | registry.redhat.io/workload-availability/node-remediation-console-rhel9@sha256:2ed8b109c7ffb6821590ec0b554f894b7c714c1b9632be260818f7178daf7baa_arm64 as a component of Red Hat OpenShift Workload Availability 0.12 | * |
| Red Hat | registry.redhat.io/workload-availability/node-healthcheck-operator-bundle@sha256:4214978132ffd6f9d840e2be8df4e9b85cf13d2740ba4f82fbe72f3d93d6dee5_amd64 as a component of Red Hat OpenShift Workload Availability 0.12 | * |
| Red Hat | registry.redhat.io/workload-availability/node-healthcheck-rhel9-operator@sha256:ae120a374dbc2935cd270351ead5a944e84fb305c704df8f41d72e32d69fbd97_ppc64le as a component of Red Hat OpenShift Workload Availability 0.12 | * |
| Red Hat | Red Hat OpenShift Workload Availability Operator | |
| Red Hat | registry.redhat.io/workload-availability/node-healthcheck-must-gather-rhel9@sha256:b906c8de5f631902847740e7ac105b74c80ab488868fde7d750dff5881ea8e5d_arm64 as a component of Red Hat OpenShift Workload Availability 0.12 | * |
| Red Hat | registry.redhat.io/workload-availability/node-healthcheck-rhel9-operator@sha256:d548561809fc5d0423fa4dfde0a906b986170f16262c47077e1a6e6889c5d5a5_s390x as a component of Red Hat OpenShift Workload Availability 0.12 | * |
| Red Hat | registry.redhat.io/workload-availability/node-remediation-console-rhel9@sha256:dbdf7d0d139bdd2661a486493805540cd6e9277aaadbde7a1414ccdc157a20e5_amd64 as a component of Red Hat OpenShift Workload Availability 0.12 | *, *, * |
| Red Hat | registry.redhat.io/workload-availability/node-healthcheck-must-gather-rhel9@sha256:b5355c3c85d9e34f22a46bb3f190bd2bfcb4f27109858010c80539c6fbeccdbe_s390x as a component of Red Hat OpenShift Workload Availability 0.12 | *, *, * |
| Red Hat | registry.redhat.io/workload-availability/node-healthcheck-rhel9-operator@sha256:6ece0ac34989350e9be7613fc533767af9ad7bf9544bad6ad297dcece2b6ca64_amd64 as a component of Red Hat OpenShift Workload Availability 0.12 | |
| Red Hat | registry.redhat.io/workload-availability/node-healthcheck-rhel9-operator@sha256:82081eb65c0d359b5d4895e72ef21955a7703a533d2a39a74e0084d398807a45_arm64 as a component of Red Hat OpenShift Workload Availability 0.12 | * |
| Red Hat | Red Hat OpenShift Workload Availability | |
| Red Hat | registry.redhat.io/workload-availability/node-healthcheck-must-gather-rhel9@sha256:ee2f7805d99ed025739bf2187649f0171c263baa0d844fe652d68b441d6dcd79_ppc64le as a component of Red Hat OpenShift Workload Availability 0.12 | * |
| Red Hat | registry.redhat.io/workload-availability/node-remediation-console-rhel9@sha256:0b237c4474bb9a64a70308f35a0645fecb20efa27d63e706b27ca091d255b311_s390x as a component of Red Hat OpenShift Workload Availability 0.12 | * |
| Red Hat | registry.redhat.io/workload-availability/node-healthcheck-rhel9-operator@sha256:ae120a374dbc2935cd270351ead5a944e84fb305c704df8f41d72e32d69fbd97_ppc64le | |
| Red Hat | registry.redhat.io/workload-availability/node-healthcheck-must-gather-rhel9@sha256:07a04832975f5740a8d36db33e304d34f4e38a870788de05112a5c31505d148e_amd64 as a component of Red Hat OpenShift Workload Availability 0.12 | * |
| golang.org/x/net |
Timeline
- Aug 12, 2026 CVE Published
- Sep 30, 2026 CVE Updated
- Sep 30, 2026 Distribution Patch
- Sep 30, 2026 Distribution Patch
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
- Sep 30, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:54287 advisory
- https://access.redhat.com/security/cve/CVE-2026-25681 advisory
- https://access.redhat.com/security/cve/CVE-2026-27136 advisory
- https://access.redhat.com/security/cve/CVE-2026-33811 advisory
- https://access.redhat.com/security/cve/CVE-2026-33814 advisory
- https://access.redhat.com/security/cve/CVE-2026-39820 advisory
- https://access.redhat.com/security/cve/CVE-2026-39821 advisory
- https://access.redhat.com/security/cve/CVE-2026-42499 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54287.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2480761 issue
- https://www.cve.org/CVERecord?id=CVE-2026-25681 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-25681 advisory
- https://go.dev/cl/781703 advisory
- https://go.dev/issue/79574 advisory
- https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8 advisory
- https://pkg.go.dev/vuln/GO-2026-5029 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2480757 issue
- https://www.cve.org/CVERecord?id=CVE-2026-27136 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-27136 advisory
…and 35 more