# CVE-2026-42502: Google Go x/net/html XSS via incorrect foreign content parsing

Source: https://junglewise.ai/threats/cve-2026-42502-google-go-x-net-html-xss-via-incorrect-foreign-content-parsing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-22. Updated: 2026-05-29  
License: CC BY 4.0 with a link back

CVE-2026-42502 · Severity: medium · CVSS 6.1 · Published 2026-05-22

A vulnerability in the Go programming language's standard networking library could allow attackers to execute malicious scripts in a user's browser. This occurs when an application parses and then displays untrusted web content, even if the application tries to clean the content first. This could lead to unauthorized actions being performed on behalf of users or the theft of sensitive session information.

Technologies: [golang.org/x/net (Go)](https://junglewise.ai/threats/technologies/golang-org-x-net). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-42502 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42502 being exploited in the wild.

**How severe is CVE-2026-42502?** Medium severity, with a CVSS score of 6.1, published 22 May 2026.

**Which products and versions are affected?** golang.org/x/net (Go) SEMVER:introduced=0,fixed=0.55.0.

**Is there a fix for CVE-2026-42502?** Yes. golang.org/x/net (Go): upgrade to 0.55.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-42502 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-42502?** Check whether you run golang.org/x/net (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- golang.org/x/net (Go): upgrade to 0.55.0 or later

  ```sh
  go get golang.org/x/net@v0.55.0
  ```


## Technical details

A Cross-Site Scripting (XSS) vulnerability exists in the golang.org/x/net/html package due to improper handling of HTML elements within 'foreign content' (such as SVG or MathML tags). When the parser processes specially crafted HTML and the resulting tree is subsequently rendered using the Render function, it can produce an HTML structure that differs from what security sanitizers expect. This discrepancy allows an attacker to bypass HTML sanitization logic and execute arbitrary JavaScript in the context of the victim's browser. The issue affects the Parse, ParseFragment, and related functions. Users should update to golang.org/x/net v0.55.0 or later to resolve this issue.

## Affected products

- Google golang.org/x/net/html before v0.55.0

## Identifiers

- CVE-2026-42502
- GO-2026-5027

## Timeline

- 2026-05-21: other: Issue reported to Go project
- 2026-05-22: disclosed: CVE published and advisory released
- 2026-05-22: patched: Fixed in golang.org/x/net v0.55.0

## References

- [https://go.dev/cl/781701](https://go.dev/cl/781701)
- [https://go.dev/issue/79572](https://go.dev/issue/79572)
- [https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8](https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8)
- [https://pkg.go.dev/vuln/GO-2026-5027](https://pkg.go.dev/vuln/GO-2026-5027)

## Related threats

- [Go html parser namespace handling in childTextNodesAreLiteral](https://junglewise.ai/threats/cve-2026-97045-in-childtextnodesareliteral-walking-up-the-tree-previously)
- [Go HTML parser quadratic time complexity in text node coalescing](https://junglewise.ai/threats/cve-2026-78661-when-coalescing-adjacent-text-nodes-in-addtext-and-fosterparent)
- [Google Go x/net denial of service in dnsmessage parsing](https://junglewise.ai/threats/cve-2026-46600-google-go-x-net-denial-of-service-in-dnsmessage-parsing)
- [Golang net/html Cross-Site Scripting via incorrect namespaced element parsing](https://junglewise.ai/threats/cve-2026-42506-golang-net-html-cross-site-scripting-via-incorrect-namespaced)
- [Go x/net idna privilege escalation via Punycode decoding](https://junglewise.ai/threats/cve-2026-39821-go-x-net-idna-privilege-escalation-via-punycode-decoding)