The golang.org/x/net/html package contains a vulnerability (CVE-2026-27136) related to improper input neutralization during HTML parsing and rendering. When arbitrary HTML is parsed and then rendered using the Render function, the resulting HTML tree may be unexpected, potentially allowing cross-site scripting attacks in applications that attempt to sanitize HTML input using this package. The CVSS 3.1 base score is 6.1 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity with no impact on availability. There is no vendor advisory or patch available at this time.

Successful exploitation can lead to cross-site scripting (XSS) attacks, which may allow an attacker to execute arbitrary scripts in the context of the affected application. This can result in limited confidentiality and integrity impact as indicated by the CVSS vector. There is no indication of availability impact. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when using golang.org/x/net/html to sanitize untrusted HTML input and consider additional layers of input validation or sanitization outside this package. Monitor vendor communications for updates on patches or official mitigations.