CVE-2026-27136: HTML Rendering XSS Vulnerability

CVE-2026-27136 Overview

CVE-2026-27136 is a Cross-Site Scripting (XSS) vulnerability affecting the Go programming language's HTML parsing and rendering functionality. Parsing arbitrary HTML and then re-rendering it via the Render function can produce an unexpected HTML tree. Attackers can leverage this mismatch to bypass HTML sanitizers and execute XSS payloads in applications that sanitize input before rendering. The issue is tracked by the Go vulnerability database as GO-2026-5030.

Critical Impact
Sanitization routines relying on parse-then-render round-trips can be bypassed, allowing attacker-controlled scripts to execute in victim browsers.

Affected Products

Go standard library golang.org/x/net/html package
Applications using Parse followed by Render for HTML sanitization
Web applications and frameworks built on the affected Go HTML packages

Discovery Timeline

2026-05-22 - CVE-2026-27136 published to NVD
2026-05-22 - Last updated in NVD database

Technical Details for CVE-2026-27136

Vulnerability Analysis

The vulnerability stems from inconsistencies between Go's HTML tokenizer and serializer. When arbitrary HTML is parsed into a DOM-like tree and then serialized via Render, the resulting output can produce a different tree if reparsed. This parser differential breaks the security assumption that sanitization performed on the parsed tree carries over to the rendered output.

Applications commonly sanitize untrusted HTML by parsing input, removing dangerous nodes or attributes, and re-rendering the cleaned tree. CVE-2026-27136 demonstrates that the rendered output can be interpreted by browsers in ways the sanitizer never saw, reintroducing script execution paths.

The vulnerability falls under the [CWE-79] Cross-Site Scripting category and is exploitable across the network with user interaction required.

Root Cause

The root cause is a mismatch between parsing and rendering semantics. The serializer does not always emit HTML that, when reparsed, yields the same node structure. Special characters, malformed tags, or context-sensitive elements such as <title>, <textarea>, <noscript>, or foreign content (SVG/MathML) can be re-encoded into a structure that browsers tokenize differently than Go did.

Attack Vector

An attacker submits crafted HTML to an application that uses Parse and Render as part of its sanitization pipeline. The sanitizer inspects the parsed tree, finds nothing malicious, and emits rendered HTML. When a victim browser loads that output, it parses the bytes into a different tree containing executable script content, triggering XSS in the victim's session context.

The vulnerability is described in detail in the Go.dev Vulnerability Advisory GO-2026-5030 and the Go.dev Issue Report #79575. A verified proof-of-concept code example is not included here.

Detection Methods for CVE-2026-27136

Indicators of Compromise

Unexpected <script>, on* event handler, or javascript: URI strings appearing in rendered HTML output that were not present in the parsed tree.
Web application logs showing user-submitted HTML containing unusual nesting of <svg>, <math>, <template>, <noscript>, or <textarea> elements.
Browser-side Content Security Policy (CSP) violation reports referencing inline script execution on pages that render user-generated HTML.

Detection Strategies

Run govulncheck against Go applications to identify modules importing the vulnerable golang.org/x/net/html symbols.
Add round-trip tests that parse rendered output a second time and compare the trees to detect serializer differentials.
Inspect outbound HTTP responses for sanitized HTML that contains script-equivalent constructs to surface bypassed sanitization.

Monitoring Recommendations

Monitor CSP violation report endpoints for spikes correlated with user-generated content features.
Alert on web application firewall (WAF) signatures matching XSS payloads embedded in fields routed through HTML sanitizers.
Track Go module versions across build pipelines and flag deployments still pinned to vulnerable golang.org/x/net releases.

How to Mitigate CVE-2026-27136

Immediate Actions Required

Upgrade golang.org/x/net/html to the fixed version referenced in Go.dev Issue CL #781685 and rebuild affected services.
Audit application code for sanitization pipelines that depend on Parse followed by Render and validate output against a strict allowlist.
Enforce a strict Content Security Policy that blocks inline script execution as a defense-in-depth control.

Patch Information

The Go team has released a fix tracked in Go.dev Issue CL #781685 and announced via the Golang Announce: Security Notice. Consult Go.dev Vulnerability Advisory GO-2026-5030 for the exact patched module version and update go.mod accordingly.

Workarounds

Replace parse-then-render sanitization with a dedicated HTML sanitization library that performs allowlist-based output encoding.
Apply contextual output encoding at the template layer using html/template rather than emitting raw rendered HTML.
Disable user-supplied HTML rendering on high-risk surfaces until the patched Go module is deployed.

bash

# Update the vulnerable module to the patched version
go get golang.org/x/net@latest
go mod tidy
govulncheck ./...