Is CVE-2026-42506 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-42506 being exploited in the wild.

How severe is CVE-2026-42506?

Medium severity, with a CVSS score of 6.1, published 22 May 2026.

Which products and versions are affected?

golang.org/x/net (Go) SEMVER:introduced=0,fixed=0.55.0.

Is there a fix for CVE-2026-42506?

Yes. golang.org/x/net (Go): upgrade to 0.55.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-42506 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-42506?

Check whether you run golang.org/x/net (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42506: Golang net/html Cross-Site Scripting via incorrect namespaced element parsing

CVE-2026-42506 · Severity: medium · CVSS 6.1 · Published 2026-05-22

A vulnerability in a common Go programming library used for processing web content could allow attackers to execute malicious scripts in a user's browser. This occurs because the library incorrectly handles certain types of web code, potentially bypassing security filters designed to clean up dangerous content. If exploited, this could lead to unauthorized actions being performed on behalf of users or the theft of sensitive session information.

Technologies: golang.org/x/net (Go). Vendors: Go.

Quick answers

Is CVE-2026-42506 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-42506 being exploited in the wild.
How severe is CVE-2026-42506?: Medium severity, with a CVSS score of 6.1, published 22 May 2026.
Which products and versions are affected?: golang.org/x/net (Go) SEMVER:introduced=0,fixed=0.55.0.
Is there a fix for CVE-2026-42506?: Yes. golang.org/x/net (Go): upgrade to 0.55.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42506 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-42506?: Check whether you run golang.org/x/net (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

golang.org/x/net (Go): upgrade to 0.55.0 or later
```
go get golang.org/x/net@v0.55.0
```

Technical details

A Cross-Site Scripting (XSS) vulnerability exists in the golang.org/x/net/html package due to improper handling of namespaced elements within foreign content (such as SVG or MathML) during parsing. When arbitrary HTML is parsed and subsequently rendered using the Render function, the resulting HTML tree may differ from the expected structure. This discrepancy allows attackers to bypass HTML sanitization libraries that rely on the parser's output, leading to the execution of malicious scripts. The issue affects the Parse, ParseFragment, and related functions. A fix is available in version v0.55.0 of the package.

Affected products

Golang net/html before v0.55.0

Identifiers

CVE-2026-42506
GO-2026-5025

Timeline

2026-05-21: other: Issue opened on GitHub
2026-05-22: disclosed: Vulnerability published by Go Project
2026-05-22: advisory: NVD entry created

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.