6.1
MediumCVSS 3.1 · from CISA
CVE-2026-27136
Invoking duplicate attributes can cause XSS in golang.org/x/net/html
golang.org/x/net/html · CWE-1021 · CWE-1021Affectedgolang.org/x/net/html
FixUpdate to 0.55.0 or newer
PublishedMay 22, 15:01 · Go
Scored6.1 · CISA
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:05 UTC
What we know
No known exploitation. CISA KEV, checked 22:05 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
Someone has to open, click or run something first. CVSS: user interaction required.
Description
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
From Go
Affected and fixed versions
ProductAffectedFixed ingolang.org/x/net/htmlbefore 0.55.00.55.0
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known