The html package (aka x/net/html) through 2018-09-17 in Go mishandles <math><template><mo><template>, leading to a "panic: runtime error" in parseCurrentToken in parse.go during an html.Parse call
{ "nvd_published_at": "2018-09-17T14:29:00Z", "cwe_ids": [ "CWE-476" ], "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2023-02-08T00:36:12Z" }