PT-2026-33004 · Goldmark · Goldmark

Catalin Iovita · Published 2026-04-15 · Updated 2026-04-17 · CVE-2026-5160

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions github.com/yuin/goldmark/renderer/html versions prior to 1.7.17

Description Improper ordering of URL validation and normalization allows Cross-site Scripting (XSS). The renderer performs a prefix-based check using the IsDangerousURL() function to validate link destinations before resolving HTML entities. An attacker can bypass protocol filtering by encoding dangerous schemes with HTML5 named character references, such as using javascript:alert(1), which results in arbitrary script execution when the application renders the URL.

Recommendations Update to version 1.7.17 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-5160

GHSA-C97M-VXHJ-P7J6

Affected Products

Goldmark

References · 11

• https://github.com/yuin/goldmark/commit/cb46bbc4eca29d55aa9721e04ad207c23ccc44f9 · Patch
• https://security-tracker.debian.org/tracker/CVE-2026-5160 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-5160 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-5160 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-5160 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-5160 · Security Note
• https://osv.dev/vulnerability/GHSA-c97m-vxhj-p7j6 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-5160 · Vendor Advisory
• https://github.com/yuin/goldmark · Note
• https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMYUINGOLDMARKRENDERERHTML-15838406 · Note
• https://twitter.com/CVEnew/status/2044338843672101176 · Twitter Post