CVE-2026-25681

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-25681
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-25681.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-25681
Aliases
Downstream
Related
Published
2026-05-22T15:01:21.975Z
Modified
2026-06-06T07:44:14.673866146Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
Details

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25681.json",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "fixed": "0.55.0"
                }
            ]
        }
    ],
    "cna_assigner": "Go"
}
References

Affected packages

Git / github.com/golang/net

Affected ranges

Type
GIT
Repo
https://github.com/golang/net
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
7770ec48d03fec35e378665337b4faca93c38423
Database specific 
{
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:golang:net:*:*:*:*:*:go:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.55.0"
        }
    ]
}

Affected versions

v0.*
v0.1.0
v0.10.0
v0.11.0
v0.12.0
v0.13.0
v0.14.0
v0.15.0
v0.16.0
v0.17.0
v0.18.0
v0.19.0
v0.2.0
v0.20.0
v0.21.0
v0.22.0
v0.23.0
v0.24.0
v0.25.0
v0.26.0
v0.27.0
v0.28.0
v0.29.0
v0.3.0
v0.30.0
v0.31.0
v0.32.0
v0.33.0
v0.34.0
v0.35.0
v0.36.0
v0.37.0
v0.38.0
v0.39.0
v0.4.0
v0.40.0
v0.41.0
v0.42.0
v0.43.0
v0.44.0
v0.45.0
v0.46.0
v0.47.0
v0.48.0
v0.49.0
v0.5.0
v0.50.0
v0.51.0
v0.52.0
v0.53.0
v0.54.0
v0.6.0
v0.7.0
v0.8.0
v0.9.0

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-25681.json"