Vulnerability GO-2026-5030

Unknown

5 months ago

Invoking duplicate attributes can cause XSS in golang.org/x/net/html

v0.1.0 - v0.54.0

Summary

Invoking duplicate attributes can cause XSS in golang.org/x/net/html

Details

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Unknown

17 days ago

Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net

v0.1.0 - v0.61.0 GO-2026-6860

Unknown

17 days ago

Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net

v0.1.0 - v0.61.0 GO-2026-6866

Unknown

1 month ago

HTTP/2 server memory exhaustion due to Trailer headers in net/http

v0.1.0 - v0.59.0 GO-2026-6603

Unknown

1 month ago

HTTP/2 transport accepts malformed framing-related headers in net/http

v0.1.0 - v0.59.0 GO-2026-6610

Unknown

1 month ago

Excessive CPU consumption from repeated initial window changes in net/http

v0.1.0 - v0.59.0 GO-2026-6611

View all vulnerabilities for these packages

Impacted packages

golang.org/x/net

Timeline

Published

5 months ago

Fixed (v0.55.0)

5 months ago

Last Modified

6 hours ago