The vulnerability CVE-2026-42502 in golang.org/x/net/html involves improper neutralization of input during web page generation (CWE-79). Specifically, parsing arbitrary HTML and rendering it with the Render function can produce an unexpected HTML tree. This behavior can be leveraged to bypass sanitization efforts in applications that sanitize input HTML before rendering, leading to cross-site scripting attacks. The vulnerability is published but lacks a CVSS score and no patch or official remediation guidance is currently available.

Applications using golang.org/x/net/html to parse and render user-supplied HTML may be vulnerable to cross-site scripting attacks if they rely on this package for sanitization. Successful exploitation could allow attackers to execute arbitrary scripts in the context of the affected application, potentially leading to session hijacking, defacement, or other client-side impacts. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, developers should avoid relying solely on golang.org/x/net/html's Render function for sanitizing untrusted HTML input. Consider using alternative, well-maintained sanitization libraries or implement additional input validation and output encoding controls to mitigate XSS risks.