UNKNOWN Go
Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
GO-2026-5029 · CVE-2026-25681
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
References
Ready to move
Start Securing
Free, no credit card | First findings in minutes