Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-25681 · CVE overview and exploitation status

EUVD-2026-31452

GHSA-w9p8-pvxh-rxpj

GO-2026-5029

cve-program · CVE-2026-25681

• https://go.dev/issue/79574
• https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8
• https://go.dev/cl/781703
• https://pkg.go.dev/vuln/GO-2026-5029

euvd · EUVD-2026-31452

• https://go.dev/issue/79574
• https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8
• https://go.dev/cl/781703
• https://pkg.go.dev/vuln/GO-2026-5029

nvd · CVE-2026-25681

• https://go.dev/cl/781703
• https://go.dev/issue/79574
• https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8
• https://pkg.go.dev/vuln/GO-2026-5029

osv · GO-2026-5029

• https://go.dev/issue/79574
• https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8
• https://go.dev/cl/781703

• Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering. · Advisory content revised · 15 Nov 2026
• Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering. · Advisory content revised · 13 Nov 2026
• Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering. · Advisory content revised · 1 Nov 2026