Threats affecting pkg:golang/github.com/yuin/goldmark

A Cross-site Scripting (XSS) vulnerability exists in github.com/yuin/goldmark/renderer/html versions before 1.7.17. The issue arises from improper ordering of URL validation and normalization, allowing attackers to bypass protocol filtering by encoding dangerous schemes with HTML5 named character references. This can lead to arbitrary script execution in applications rendering the affected URLs. The vulnerability has a medium severity with a CVSS score of 5.1. No official patch or remediation guidance is currently confirmed.