{"id":"EUVD-2026-111400","enisaUuid":"7007ab68-630f-3430-8bf5-138b7fbd88ef","description":"In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as \u003cmglyph\u003e or \u003cmalignmark\u003e fostered under \u003cmtext\u003e), causing a parser to resolve the subtree in a different foreign namespace upon re-parsing the rendered output. Continue walking the full ancestor chain and verify that every transition from a non-empty namespace occurs at an HTML integration point before emitting literal text.","datePublished":"Oct 27, 2026, 9:38:56 PM","dateUpdated":"Oct 27, 2026, 9:38:56 PM","baseScore":0.0,"references":"https://go.dev/cl/855121\nhttps://go.dev/issue/82622\nhttps://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs\nhttps://pkg.go.dev/vuln/GO-2026-6866\n","aliases":"CVE-2026-97045\nGHSA-vwcj-r8v9-p53f\n","assigner":"Go","epss":0.0,"enisaIdProduct":[{"id":"89f5ad6d-012b-3455-a347-5268dd7f84fa","product":{"name":"golang.org/x/net/html","vendor":{"name":"golang.org/x/net"}},"product_version":"0 \u003c0.62.0"}],"enisaIdVendor":[{"id":"7e965427-35f8-3b9d-9d40-ad5d2ff76e04","vendor":{"name":"golang.org/x/net"}}],"enisaIdVulnerability":[{"id":"e5cb0661-03ff-36fe-802d-df62984bd36b","vulnerability":{"id":"CVE-2026-97045","description":"In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as \u003cmglyph\u003e or \u003cmalignmark\u003e fostered under \u003cmtext\u003e), causing a parser to resolve the subtree in a different foreign namespace upon re-parsing the rendered output. Continue walking the full ancestor chain and verify that every transition from a non-empty namespace occurs at an HTML integration point before emitting literal text.","datePublished":"Oct 27, 2026, 9:38:56 PM","dateUpdated":"Oct 27, 2026, 9:38:56 PM","status":"PUBLISHED","baseScore":0.0,"references":"https://go.dev/cl/855121\nhttps://go.dev/issue/82622\nhttps://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs\nhttps://pkg.go.dev/vuln/GO-2026-6866\n","enisa_id":"EUVD-2026-111400\n","assigner":"Go","epss":0.0,"dataProcessed":"Oct 28, 2026, 12:00:31 PM","vulnerabilityProduct":[{"id":"57f62eac-463d-3b1e-bb8e-3fad4e0a1f2a","product":{"name":"golang.org/x/net/html","vendor":{"name":"golang.org/x/net"}},"product_version":"0 \u003c0.62.0"}],"vulnerabilityVendor":[{"id":"39427535-2766-3131-8944-7e53a61e155c","vendor":{"name":"golang.org/x/net"}}]}},{"id":"eb89d761-9e50-3d66-aef0-789a0aee0041","vulnerability":{"id":"GHSA-vwcj-r8v9-p53f","description":"In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as \u003cmglyph\u003e or \u003cmalignmark\u003e fostered under \u003cmtext\u003e), causing a parser to resolve the subtree in a different foreign namespace upon re-parsing the rendered output. Continue walking the full ancestor chain and verify that every transition from a non-empty namespace occurs at an HTML integration point before emitting literal text.","datePublished":"Oct 28, 2026, 12:30:30 AM","dateUpdated":"Oct 28, 2026, 12:30:30 AM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-97045\nhttps://go.dev/cl/855121\nhttps://go.dev/issue/82622\nhttps://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs\nhttps://pkg.go.dev/vuln/GO-2026-6866\n","enisa_id":"EUVD-2026-111400\n","aliases":"GHSA-vwcj-r8v9-p53f\nCVE-2026-97045\n","epss":0.0,"dataProcessed":"Oct 28, 2026, 12:01:16 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}