Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-42502 · CVE overview and exploitation status

EUVD-2026-31448

GHSA-wrh2-89vg-4j9g

GO-2026-5027

cve-program · CVE-2026-42502

• https://go.dev/issue/79572
• https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8
• https://go.dev/cl/781701
• https://pkg.go.dev/vuln/GO-2026-5027

euvd · EUVD-2026-31448

• https://go.dev/issue/79572
• https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8
• https://go.dev/cl/781701
• https://pkg.go.dev/vuln/GO-2026-5027

nvd · CVE-2026-42502

• https://go.dev/cl/781701
• https://go.dev/issue/79572
• https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8
• https://pkg.go.dev/vuln/GO-2026-5027

osv · GO-2026-5027

• https://go.dev/issue/79572
• https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8
• https://go.dev/cl/781701

• Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering. · Advisory content revised · 1 Nov 2026