The golang.org/x/net/html package contains a vulnerability (CVE-2026-42506) classified as CWE-79, involving improper neutralization of input during web page generation. Specifically, when arbitrary HTML is parsed and then rendered using the Render function, the resulting HTML tree may be unexpected and enable cross-site scripting attacks. This affects applications relying on this package for HTML sanitization and rendering. The vulnerability was published on 2026-05-22, but no CVSS score or remediation level has been assigned yet.

Applications using golang.org/x/net/html to sanitize and render user-supplied HTML may be vulnerable to cross-site scripting attacks due to unexpected HTML tree generation. This could allow attackers to execute arbitrary scripts in the context of the affected application, potentially leading to session hijacking, data theft, or other client-side impacts. No known exploits have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid relying solely on golang.org/x/net/html for sanitizing untrusted HTML input or implement additional sanitization layers. Monitor the official golang.org/x/net project for updates and patches addressing this vulnerability.