CVE-2026-25681: HTML Parsing XSS Vulnerability

CVE-2026-25681 Overview

CVE-2026-25681 affects the Go golang.org/x/net/html package. Parsing arbitrary HTML and re-rendering it with the Render function can produce an HTML tree that differs from the original parsed structure. Attackers can exploit this mismatch to smuggle markup past sanitizers that rely on parse-then-render workflows. The result is reflected or stored Cross-Site Scripting (XSS) in applications that sanitize untrusted HTML before serving it. The vulnerability is tracked upstream as GO-2026-5029 and was published to the National Vulnerability Database (NVD) on 2026-05-22.

Critical Impact
Applications using html.Parse followed by html.Render for HTML sanitization can be bypassed, enabling XSS execution in the victim's browser context.

Affected Products

golang.org/x/net/html package (Go networking extensions)
Go applications using Parse and Render for HTML sanitization
Downstream sanitization libraries that depend on x/net/html tree round-tripping

Discovery Timeline

2026-05-22 - CVE-2026-25681 published to NVD
2026-05-22 - Last updated in NVD database

Technical Details for CVE-2026-25681

Vulnerability Analysis

The flaw stems from a parser-renderer asymmetry in the x/net/html package. When Parse consumes untrusted HTML, the resulting node tree does not always serialize back to equivalent markup through Render. Specific input sequences cause Render to emit tags, attributes, or text nodes that re-tokenize differently when the browser parses them. Applications that sanitize HTML by walking the parse tree, removing disallowed nodes, and re-rendering then trust the output as safe. The mismatch between Render output and a browser's HTML parsing state machine breaks that trust boundary. An attacker can craft input that survives sanitization at the tree level but reconstitutes into executable script when rendered in a browser.

Root Cause

The root cause is incomplete fidelity between the HTML tokenizer, the tree builder, and the serializer in x/net/html. Edge cases involving foreign content, special elements such as <template>, <noscript>, or <plaintext>, and unusual attribute encoding cause Render to produce output that the browser parses into a different DOM than the one inspected during sanitization.

Attack Vector

Exploitation requires user interaction, typically loading a page that displays attacker-controlled HTML. The attacker submits crafted markup to an application that uses x/net/html to sanitize input. The sanitizer parses the input, removes script-like nodes, and re-renders the cleaned tree. The rendered output reaches the victim's browser, which parses it into a different DOM containing attacker-controlled JavaScript. Refer to the Go.dev Vulnerability Report and Go.dev Issue Discussion for the specific input patterns.

Detection Methods for CVE-2026-25681

Indicators of Compromise

Unexpected <script>, <svg>, or event-handler attributes appearing in rendered output after sanitization
HTTP request bodies containing unusual <template>, <noscript>, <math>, or <svg> nesting submitted to user-content endpoints
Reflected user content where the rendered DOM contains more nodes or different tags than the sanitized tree

Detection Strategies

Inventory Go services that import golang.org/x/net/html using go list -m all and identify versions predating the upstream fix
Compare sanitizer input and output by re-parsing rendered HTML and asserting tree equivalence in CI tests
Deploy Content Security Policy (CSP) reporting to surface inline-script violations originating from sanitized fields

Monitoring Recommendations

Log and alert on CSP script-src violation reports tied to user-generated content endpoints
Monitor web application firewall (WAF) telemetry for HTML payloads containing foreign-content or template-element fragments
Track dependency manifests in source repositories for unpatched golang.org/x/net versions

How to Mitigate CVE-2026-25681

Immediate Actions Required

Upgrade golang.org/x/net to the fixed release referenced in the Google Groups Announcement
Rebuild and redeploy all Go binaries that statically link the vulnerable package
Audit any custom sanitizer logic built on top of html.Parse and html.Render for round-trip assumptions

Patch Information

The upstream fix is documented in the Go.dev Change Log Entry. Update the dependency with go get golang.org/x/net@latest and verify with go mod tidy. Track the advisory in the Go.dev Vulnerability Report.

Workarounds

Replace parse-and-render sanitization with an allowlist library that emits HTML directly rather than serializing a parse tree
Apply a strict CSP that disallows inline scripts and event-handler attributes for pages displaying user content
Encode untrusted content as text where rich HTML is not required

bash

# Update the vulnerable module and verify the resolved version
go get golang.org/x/net@latest
go mod tidy
go list -m golang.org/x/net

# Scan for residual vulnerable versions using govulncheck
go install golang.org/x/vuln/cmd/govulncheck@latest
govulncheck ./...