Search: CVE-2026-25681

CVE-2026-25681 is a medium severity cross-site scripting (XSS) vulnerability in the golang.org/x/net/html package. It arises when parsing arbitrary HTML and rendering it with the Render function, which can produce an unexpected HTML tree. This improper neutralization of input during web page generation may allow XSS attacks in applications relying on this package for HTML sanitization. No official patch or remediation guidance is currently available, and no known exploits exist in the wild.