Search: CVE-2026-27136

CVE-2026-27136 is a medium severity vulnerability in the golang.org/x/net/html package where parsing arbitrary HTML and rendering it using the Render function can produce an unexpected HTML tree. This behavior may be exploited to perform cross-site scripting (XSS) attacks in applications that rely on this package to sanitize input HTML before rendering. The vulnerability involves improper neutralization of input during web page generation (CWE-79). No official patch or remediation guidance is currently available from the vendor, and no known exploits are reported in the wild.