Fluid Attacks Database

Description

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
go	golang.org/x/net	>=0 <0.55.0	0.55.0
rpm rhel10	grafana	-	-
rpm rhel9	grafana	-	-
rpm rhel10	gvisor-tap-vsock	-	-
rpm rhel9	gvisor-tap-vsock	-	-
rpm rhel10	image-builder	-	-
rpm rhel9	image-builder	-	-
rpm rhel8	osbuild-composer	-	-
rpm rhel9	podman	-	-
debian 13	golang-golang-x-net	=1:0.27.0-2 \|\| =1:0.47.0-1 \|\| =1:0.47.0-2 \|\| =1:0.53.0-1 \|\| =1:0.53.0-2 \|\| =1:0.53.0-2~bpo13+1 \|\| =1:0.55.0-1 \|\| =1:0.56.0-1 \|\| =1:0.57.0-1 \|\| =1:0.58.0-1	-

1-10 of 19

Aliases

1. CVE-2026-425062. NVD-2026-425063. OSV-GO-2026-50254. OSV-2026-425065. OSV-DEBIAN-2026-425066. GCVE-2026-425067. SECURITY-TRACKER-CVE-2026-42506

References

1. https://go.dev/issue/795712. https://groups.google.com/g/golang-announce/c/iI-mYSI0lu83. https://go.dev/cl/781700

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.