The golang.org/x/net/html package contains a vulnerability (CVE-2026-42506) classified as CWE-79, where the Render function can produce an unexpected HTML tree when parsing arbitrary HTML input. This flaw leads to improper neutralization of input during web page generation, enabling potential cross-site scripting (XSS) attacks in applications that use this package to sanitize HTML before rendering. The vulnerability has a CVSS 3.1 base score of 6.1 (medium severity) with network attack vector, low attack complexity, no privileges required, requires user interaction, and impacts confidentiality and integrity with no availability impact. No official patch or remediation guidance is currently available from the vendor, and no known exploits have been reported.

Successful exploitation of this vulnerability can lead to cross-site scripting attacks, allowing attackers to inject malicious scripts into web pages generated by applications using the vulnerable package. This can compromise the confidentiality and integrity of data processed or displayed by the affected applications. However, there are no known exploits in the wild at this time.

No official patch or remediation guidance is currently available from the vendor. Users should monitor the vendor's advisories for updates and consider implementing additional input validation or output encoding as a temporary mitigation until an official fix is released.