PT-2026-42781 · Go+1 · Golang.Org/X/Net+1

Ensy · Published 2026-05-22 · Updated 2026-05-22 · CVE-2026-27136

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description Parsing arbitrary HTML that is subsequently rendered using the Render function can lead to the creation of an unexpected HTML tree. This behavior can be exploited to perform Cross-Site Scripting (XSS) attacks—a technique where malicious scripts are injected into trusted websites—specifically in applications that attempt to sanitize input HTML before the rendering process.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-27136

GO-2026-5030

Affected Products

Golang.Org/X/Net

Golang.Org/X/Net/Html

References · 5

• https://osv.dev/vulnerability/GO-2026-5030 · Vendor Advisory
• https://go.dev/cl/781685 · Note
• https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8 · Note
• https://pkg.go.dev/vuln/GO-2026-5030 · Note
• https://go.dev/issue/79575 · Note