Vulnerabilities

TI-2026-21586 CVE-2026-27136 · GHSA-m9x8-m34x-fj9q

Invoking duplicate attributes can cause XSS in golang.org/x/net/html

LOW 27

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00223 Published 2026-05-22 Partial fix · 0.55.0 CWE-1021

TI-2026-20766 CVE-2026-25681 · GHSA-w9p8-pvxh-rxpj

LOW 27

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00223 Published 2026-05-22 Partial fix · 0.55.0 CWE-1021

TI-2026-20765 CVE-2026-25680 · GHSA-5cv4-jp36-h3mw

LOW 29

Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00326 Published 2026-05-22 Partial fix · 0.55.0 CWE-400

TI-2026-30785 CVE-2026-42502 · GHSA-wrh2-89vg-4j9g

LOW 27

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00223 Published 2026-05-22 Partial fix · 0.55.0 CWE-1021

TI-2026-30789 CVE-2026-42506 · GHSA-cg87-vwwh-xvgj

LOW 27

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00235 Published 2026-05-22 Partial fix · 0.55.0 CWE-79