GO-2026-5025

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Medium highest severity reported · also known as CVE-2026-42506

6
catalog tools match this advisory
4
ship the vulnerable code in their release binary (Go tools analyzed with govulncheck)
No
in the CISA KEV catalog
0.2%
EPSS for CVE-2026-42506, percentile 15

Catalog tools matching GO-2026-5025

ToolVersion scannedPackageFixed inReleased binaryDeclared in or found inDispute
bomber
Software Composition Analysis (SCA)
v0.5.1golang.org/x/net@v0.29.0
golang
0.55.0vulnerable code in binarygo.modDispute
clair
Container Security › Image Scanning
v4.9.0golang.org/x/net@v0.47.0
golang
0.55.0vulnerable code in binarygo.modDispute
kube-linter
Kubernetes Security
v0.8.3golang.org/x/net@v0.48.0
golang
0.55.0vulnerable code in binarygo.modDispute
kube-linter
Kubernetes Security
v0.8.3golang.org/x/net@v0.50.0
golang
0.55.0vulnerable code in binarytool-imports/go.modDispute
dive
Container Security › Image Scanning
v0.13.1golang.org/x/net@v0.37.0
golang
0.55.0vulnerable code in binarygo.modDispute
tracee
Container Security › Runtime Security
v0.24.1golang.org/x/net@v0.38.0
golang
0.55.0module in binarycmd/traceectl/go.modDispute
tracee
Container Security › Runtime Security
v0.24.1golang.org/x/net@v0.42.0
golang
0.55.0module in binarygo.modDispute
slsa-verifier
Supply Chain Compliance
v2.7.1golang.org/x/net@v0.38.0
golang
0.55.0module in binarygo.modDispute

Vulnerabilities are known advisories that Grype matches against the dependencies declared in each project's release source (manifests and lockfiles, including development and build dependencies). A match does not mean the tool is exploitable: the vulnerable code may be unused, test-only, or not shipped in the released binary. KEV: listed in the CISA Known Exploited Vulnerabilities catalog. EPSS: FIRST's estimated probability of exploitation in the next 30 days. Both describe the vulnerability in general, not its exploitability through this tool; a match in a workflow file refers to a GitHub Action, not to shipped code. Released binary is only analyzed for Go tools with a Linux release binary; other tools show not analyzed.

Advisory sources

Go vulnerability GO-2026-5025 · NVD CVE-2026-42506 · OSV GO-2026-5025

Grype data sources: https://go.dev/issue/79571