Fluid Attacks Database

Description

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
rpm rhel9	grafana	<0:10.2.6-23.el9_8	0:10.2.6-23.el9_8
rpm rhel10	gvisor-tap-vsock	-	-
rpm rhel10.0	grafana	<0:10.2.6-26.el10_0	0:10.2.6-26.el10_0
rpm rhel10.0	osbuild-composer	<0:134.1-10.el10_0	0:134.1-10.el10_0
go	golang.org/x/net	>=0 <0.55.0	0.55.0
debian 12	golang-golang-x-net	=1:0.10.0-1 \|\| =1:0.11.0-1 \|\| =1:0.14.0-1 \|\| =1:0.15.0-1 \|\| =1:0.15.0-2 \|\| =1:0.17.0+dfsg-1 \|\| =1:0.19.0+dfsg-1 \|\| =1:0.20.0+dfsg-1 \|\| =1:0.21.0+dfsg-1 \|\| =1:0.22.0+dfsg-1 \|\| =1:0.23.0+dfsg-1 \|\| =1:0.24.0+dfsg-1 \|\| =1:0.25.0+dfsg-1 \|\| =1:0.26.0+dfsg-1 \|\| =1:0.26.0+dfsg-2 \|\| =1:0.27.0-1 \|\| =1:0.27.0-2 \|\| =1:0.47.0-1 \|\| =1:0.47.0-2 \|\| =1:0.53.0-1 \|\| =1:0.53.0-2 \|\| =1:0.53.0-2~bpo13+1 \|\| =1:0.55.0-1 \|\| =1:0.56.0-1 \|\| =1:0.57.0-1 \|\| =1:0.58.0-1 \|\| =1:0.7.0+dfsg-1	-
debian 13	golang-golang-x-net	=1:0.27.0-2 \|\| =1:0.47.0-1 \|\| =1:0.47.0-2 \|\| =1:0.53.0-1 \|\| =1:0.53.0-2 \|\| =1:0.53.0-2~bpo13+1 \|\| =1:0.55.0-1 \|\| =1:0.56.0-1 \|\| =1:0.57.0-1 \|\| =1:0.58.0-1	-
debian 14	golang-golang-x-net	=1:0.27.0-2 \|\| =1:0.47.0-1 \|\| =1:0.47.0-2 \|\| =1:0.53.0-1 \|\| =1:0.53.0-2 \|\| =1:0.53.0-2~bpo13+1 \|\| >=0 <1:0.55.0-1	1:0.55.0-1
rpm rhel10	grafana	<0:10.2.6-27.el10_2	0:10.2.6-27.el10_2
rpm rhel10	image-builder	<0:52.1-2.el10_2	0:52.1-2.el10_2

1-10 of 24

Aliases

1. CVE-2026-256812. NVD-2026-256813. OSV-2026-256814. OSV-GO-2026-50295. OSV-DEBIAN-2026-256816. GCVE-2026-256817. SECURITY-TRACKER-CVE-2026-25681

References

1. https://go.dev/issue/795742. https://groups.google.com/g/golang-announce/c/iI-mYSI0lu83. https://go.dev/cl/781703

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.