Executive brief
A vulnerability exists in a widely used Go networking library that handles HTML parsing. If an application uses this library to process and clean up user-provided web content, an attacker could bypass security filters to execute malicious scripts in a victim's browser. This could lead to unauthorized actions being performed on behalf of users or the theft of sensitive session information.
Technical details
A Cross-Site Scripting (XSS) vulnerability exists in the golang.org/x/net/html package due to improper handling of character references within DOCTYPE nodes. When the library's Parse or ParseFragment functions process specially crafted HTML, they generate an unexpected DOM tree that differs from how a browser might interpret the same markup. An attacker can exploit this discrepancy to bypass HTML sanitization libraries that rely on x/net/html for parsing, allowing the injection of malicious scripts. The issue is fixed in version 0.55.0 of the x/net package.
Affected products
- Golang x/net/html < 0.55.0
Timeline
- 2026-05-21: disclosed: Issue reported to Go project
- 2026-05-22: advisory: CVE-2026-25681 published
- 2026-05-29: patched: NIST analysis updated with version 0.55.0 fix information