Is CVE-2026-25681 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-25681 being exploited in the wild.

How severe is CVE-2026-25681?

Medium severity, with a CVSS score of 6.1, published 22 May 2026.

Which products and versions are affected?

golang.org/x/net (Go) SEMVER:introduced=0,fixed=0.55.0; Google Html < 0.55.0.

Is there a fix for CVE-2026-25681?

Yes. golang.org/x/net (Go): upgrade to 0.55.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-25681 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-25681?

Check whether you run golang.org/x/net (Go) or Google Html at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-25681: Golang x/net/html XSS via improper DOCTYPE parsing

Q: Is there a fix for CVE-2026-25681?

Yes. golang.org/x/net (Go): upgrade to 0.55.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-25681 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-25681?

Check whether you run golang.org/x/net (Go) or Google Html at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-25681 · Severity: medium · CVSS 6.1 · Published 2026-05-22

A vulnerability exists in a widely used Go networking library that handles HTML parsing. If an application uses this library to process and clean up user-provided web content, an attacker could bypass security filters to execute malicious scripts in a victim's browser. This could lead to unauthorized actions being performed on behalf of users or the theft of sensitive session information.

Technologies: golang.org/x/net (Go). Vendors: Go, Google.

Quick answers

Is CVE-2026-25681 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-25681 being exploited in the wild.
How severe is CVE-2026-25681?: Medium severity, with a CVSS score of 6.1, published 22 May 2026.
Which products and versions are affected?: golang.org/x/net (Go) SEMVER:introduced=0,fixed=0.55.0; Google Html < 0.55.0.
Is there a fix for CVE-2026-25681?: Yes. golang.org/x/net (Go): upgrade to 0.55.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-25681 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-25681?: Check whether you run golang.org/x/net (Go) or Google Html at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

golang.org/x/net (Go): upgrade to 0.55.0 or later
```
go get golang.org/x/net@v0.55.0
```

Technical details

A Cross-Site Scripting (XSS) vulnerability exists in the golang.org/x/net/html package due to improper handling of character references within DOCTYPE nodes. When the library's Parse or ParseFragment functions process specially crafted HTML, they generate an unexpected DOM tree that differs from how a browser might interpret the same markup. An attacker can exploit this discrepancy to bypass HTML sanitization libraries that rely on x/net/html for parsing, allowing the injection of malicious scripts. The issue is fixed in version 0.55.0 of the x/net package.

Affected products

Golang x/net/html < 0.55.0

Identifiers

CVE-2026-25681
GO-2026-5029

Timeline

2026-05-21: disclosed: Issue reported to Go project
2026-05-22: advisory: CVE-2026-25681 published
2026-05-29: patched: NIST analysis updated with version 0.55.0 fix information

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.