CVE-2026-27136

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-27136
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-27136.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-27136
Aliases
Downstream
Related
Published
2026-05-22T15:01:22.111Z
Modified
2026-06-06T07:44:13.470955108Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
Invoking duplicate attributes can cause XSS in golang.org/x/net/html
Details

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27136.json",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "fixed": "0.55.0"
                }
            ]
        }
    ],
    "cna_assigner": "Go"
}
References

Affected packages

Git / github.com/golang/net

Affected ranges

Type
GIT
Repo
https://github.com/golang/net
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
7770ec48d03fec35e378665337b4faca93c38423
Database specific 
{
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:golang:net:*:*:*:*:*:go:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.55.0"
        }
    ]
}

Affected versions

v0.*
v0.1.0
v0.10.0
v0.11.0
v0.12.0
v0.13.0
v0.14.0
v0.15.0
v0.16.0
v0.17.0
v0.18.0
v0.19.0
v0.2.0
v0.20.0
v0.21.0
v0.22.0
v0.23.0
v0.24.0
v0.25.0
v0.26.0
v0.27.0
v0.28.0
v0.29.0
v0.3.0
v0.30.0
v0.31.0
v0.32.0
v0.33.0
v0.34.0
v0.35.0
v0.36.0
v0.37.0
v0.38.0
v0.39.0
v0.4.0
v0.40.0
v0.41.0
v0.42.0
v0.43.0
v0.44.0
v0.45.0
v0.46.0
v0.47.0
v0.48.0
v0.49.0
v0.5.0
v0.50.0
v0.51.0
v0.52.0
v0.53.0
v0.54.0
v0.6.0
v0.7.0
v0.8.0
v0.9.0

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-27136.json"