The vulnerability involves improper neutralization of input during web page generation (CWE-79) in the golang.org/x/net/html package. Specifically, parsing arbitrary HTML and rendering it with the Render function can produce an unexpected HTML structure that attackers may leverage to execute cross-site scripting attacks. This affects applications that use this package to sanitize input HTML before rendering, potentially allowing malicious script injection.

Applications using golang.org/x/net/html to sanitize and render user-supplied HTML may be vulnerable to XSS attacks due to the unexpected HTML tree generated by the Render function. This can lead to client-side script execution, which may result in session hijacking, defacement, or other client-side impacts typical of XSS vulnerabilities. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented at this time. Until a patch is available, users should consider additional input validation or alternative sanitization methods outside of golang.org/x/net/html to prevent XSS risks.