This vulnerability (CVE-2026-25681) affects the golang.org/x/net/html package, specifically its Render function. When parsing arbitrary HTML, the function may generate an unexpected HTML tree due to improper neutralization of input, leading to a cross-site scripting (CWE-79) vulnerability. The issue can impact applications that use this package for HTML sanitization, potentially allowing injection of malicious scripts. The CVSS score is 6.1 (medium severity), indicating a network attack vector with low complexity and requiring user interaction, with partial confidentiality and integrity impact but no availability impact. There is currently no official patch or remediation guidance, and no known exploits have been reported in the wild.

The vulnerability can lead to cross-site scripting attacks in applications that rely on golang.org/x/net/html for sanitizing or rendering HTML content. This may allow attackers to inject malicious scripts that compromise confidentiality and integrity of data processed or displayed by the affected applications. However, no known exploits are currently active in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when using the Render function on untrusted HTML input and consider additional application-level input validation or sanitization measures.