{"id":"GO-2026-6866","revision":"b6ca35071b0b46519e2efd24cc07ad26","records":[{"revision":"b6ca35071b0b46519e2efd24cc07ad26","observedAt":"2026-10-27T21:48:52.964+00:00","statement":{"source":"osv","id":"GO-2026-6866","aliases":["CVE-2026-97045"],"title":"Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net","description":"In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as <mglyph> or <malignmark> fostered under <mtext>), causing a parser to resolve the subtree in a different foreign namespace upon re-parsing the rendered output.\n\nContinue walking the full ancestor chain and verify that every transition from a non-empty namespace occurs at an HTML integration point before emitting literal text.","state":0,"publishedAt":"2026-10-27T21:16:18+00:00","modifiedAt":"2026-10-27T21:45:08.9780773+00:00","affected":[{"ecosystem":"Go","name":"golang.org/x/net","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.62.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://go.dev/cl/855121","https://go.dev/issue/82622","https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6866","license":"OSV · upstream source license applies","key":"osv:GO-2026-6866","identifiers":["GO-2026-6866","CVE-2026-97045"]},"retained":false,"historicalAffected":[]}],"coverage":[]}