CVE-2026-42506

What it actually does

This is a cross-site scripting weakness in Go's net-related HTML parsing/rendering flow where arbitrary HTML can be parsed into an unexpected document tree and then serialized with Render in a form that differs from what the application believed it had sanitized. Applications that sanitize user-supplied HTML before rendering may make security decisions on one structure while browsers interpret the final rendered output differently, allowing attacker-controlled markup, attributes, or scriptable elements to survive and execute in a victim's browser. The CVSS vector indicates network exploitability, low attack complexity, no required attacker privileges, required user interaction, and potential confidentiality and integrity impact across a changed browser security scope.

Why it matters to the business

Applications that accept and display user-generated HTML, comments, descriptions, profiles, messages, or rich-text content could unintentionally deliver attacker-controlled JavaScript to users. Successful exploitation can lead to account takeover, session theft where cookies or tokens are exposed, fraudulent actions performed as the victim, defacement, phishing inside a trusted application, or data exposure visible to the victim. The vulnerability is not currently listed in CISA KEV, has low EPSS, no known exploit maturity in the provided data, and no ransomware association, so broad active exploitation is not indicated; however, XSS issues in shared parsing libraries can have wide downstream impact wherever the vulnerable rendering pattern is used.

How an attack unfolds

An attacker identifies an application built with the affected Go net HTML functionality that accepts arbitrary or semi-trusted HTML and later renders it back to other users. The attacker crafts malformed or edge-case HTML that is interpreted one way by the application's sanitizer but transformed by the parser/rendering process into a different HTML tree. After Render serializes the content, the browser receives markup containing executable script behavior, such as dangerous event handlers, scriptable URLs, or namespace-based elements that bypassed the original checks. The attacker stores the payload in persistent content or sends it through a reflected input path. When a victim views the affected page, the browser executes the injected JavaScript in the context of the trusted application, enabling theft of accessible data, unauthorized user actions, phishing overlays, or session abuse depending on browser and application protections.

How to fix it

Upgrade the affected Go module/package as soon as an official fixed version is available from the Go project or the Go vulnerability database. No exact fixed version was provided in the input, so teams should monitor advisories for golang.org/x/net or the relevant Go net HTML component and pin to the first non-vulnerable release once published. As immediate mitigation, do not rely on parse-then-render behavior alone for sanitizing untrusted HTML. Use a mature allowlist-based HTML sanitizer that is explicitly safe for browser rendering, sanitize after any parsing or transformation step that can change the tree, and apply context-appropriate output encoding. Where rich HTML is not required, render user input as text rather than HTML. Add defense-in-depth controls such as a restrictive Content Security Policy that avoids unsafe-inline, HttpOnly and SameSite cookies, and separation of untrusted user content onto a distinct origin when practical.

How to confirm the fix worked

Inventory Go applications and dependencies for use of the affected Go net HTML parsing/rendering component, including direct and transitive references to golang.org/x/net. Use commands such as go list -m all and dependency scanners to identify versions in use, then compare them with the latest Go vulnerability database guidance. Review code paths that parse arbitrary HTML, sanitize it, and then call rendering/serialization functions before returning content to browsers. Confirm remediation by upgrading or applying mitigations, rebuilding and redeploying affected services, and running regression tests with malformed HTML payloads that previously produced unexpected rendered output. Validate browser-side behavior by confirming user-controlled HTML is either safely escaped, stripped to an allowlist, or rendered without executable attributes, scriptable URLs, or active content. Confirm CSP headers are present and block inline script execution where possible.

Typical attack path

1. Find an application using Go's affected net HTML parsing/rendering behavior for user-supplied rich text or HTML.
2. Submit crafted malformed HTML designed to cause a mismatch between the sanitized tree and the rendered/browser-interpreted tree.
3. Have the application parse, sanitize, and render the content using the vulnerable workflow.
4. Deliver the rendered content to a victim through stored content, shared links, messages, comments, or another user-facing page.
5. Trigger JavaScript execution in the victim's browser under the trusted application's origin.
6. Use the script execution to read accessible page data, perform actions as the victim, steal non-HttpOnly tokens, or present convincing phishing content.

How to detect it

Detection should focus on evidence of attempted or successful XSS payload delivery through inputs that accept HTML or rich text. Review web access logs, WAF logs, application request logs, API gateway logs, and stored user-generated content for encoded or raw HTML containing script tags, event-handler attributes, scriptable URI schemes, SVG/MathML payloads, malformed tag nesting, or unusual parser-confusion sequences. For stored-XSS scenarios, inspect database-backed content repositories, comments, profile fields, messages, tickets, descriptions, and CMS entries that are rendered to browsers. Browser execution evidence may appear as unusual outbound requests from users' browsers to attacker-controlled domains, reports from CSP violation endpoints, abnormal account actions immediately after viewing specific content, or spikes in requests containing document.cookie, localStorage, fetch, XMLHttpRequest, or beacon-style exfiltration patterns. Because this vulnerability does not define a single universal payload, the listed indicators are suspicious search terms rather than definitive proof of compromise and should be correlated with affected application code paths and user activity.

• <script
• </script>
• %3Cscript
• onerror=
• onload=
• onclick=
• onmouseover=
• javascript:
• data:text/html
• <svg
• %3Csvg
• <math
• %3Cmath
• <iframe
• %3Ciframe
• srcdoc=
• document.cookie
• localStorage
• sessionStorage
• XMLHttpRequest
• navigator.sendBeacon
• fetch(
• eval(
• alert(
• prompt(
• confirm(
• </style>
• </textarea>
• </title>
• xlink:href=

What your security team should do

• Identify internet-facing and user-facing Go applications that accept, store, transform, or display user-supplied HTML or rich text.
• Prioritize review of code paths using Go HTML parsing/rendering for sanitization or canonicalization decisions, especially where output is displayed to authenticated users or administrators.
• Monitor the Go vulnerability database and vendor advisories for an official fixed version, then upgrade and rebuild affected applications promptly.
• Until a fixed version is deployed, sanitize after all HTML parsing/transformation steps or render untrusted content as escaped text.
• Add or tighten Content Security Policy to reduce XSS impact, specifically avoiding unsafe-inline and restricting script-src to trusted sources.
• Review authentication cookies and tokens to ensure sensitive cookies are HttpOnly, Secure, and SameSite where compatible.
• Search recent access logs, application logs, and stored user-generated content for common XSS payload patterns and malformed HTML submitted to fields that render HTML.
• Add security regression tests for HTML sanitizer bypass cases so future parser or renderer changes do not reintroduce unsafe output.