CVE-2026-5160: Goldmark Renderer XSS Vulnerability

CVE-2026-5160 Overview

A Cross-site Scripting (XSS) vulnerability exists in the Goldmark Markdown parser's HTML renderer component (github.com/yuin/goldmark/renderer/html) prior to version 1.7.17. The vulnerability stems from improper ordering of URL validation and normalization processes, allowing attackers to bypass protocol filtering mechanisms through HTML5 named character reference encoding.

Critical Impact

Attackers can execute arbitrary JavaScript code in the context of applications that render user-supplied Markdown content, potentially leading to session hijacking, credential theft, and unauthorized actions on behalf of users.

Affected Products

• github.com/yuin/goldmark/renderer/html versions prior to 1.7.17
• Go applications utilizing the vulnerable Goldmark HTML renderer for Markdown processing
• Web applications rendering untrusted Markdown content through Goldmark

Discovery Timeline

• April 15, 2026 - CVE-2026-5160 published to NVD
• April 15, 2026 - Last updated in NVD database

Technical Details for CVE-2026-5160

Vulnerability Analysis

The Goldmark HTML renderer implements a security check called IsDangerousURL that uses prefix-based validation to identify and block dangerous URL schemes such as javascript:. However, a critical flaw exists in the order of operations: the URL validation occurs before HTML entity resolution.

This sequencing error means that when a malicious payload like javascript:alert(1) is processed, the IsDangerousURL function examines the literal string containing the HTML entity : rather than the resolved colon character. Since the string doesn't match the expected javascript: prefix pattern, it passes validation. Subsequently, when the URL is rendered in the browser, HTML entity decoding converts : to :, resulting in an executable javascript:alert(1) URL.

This vulnerability is classified as CWE-79 (Cross-site Scripting) and affects any application that processes untrusted Markdown input through the vulnerable renderer.

Root Cause

The root cause is a time-of-check-time-of-use (TOCTOU) style vulnerability in the URL sanitization logic. The security validation layer checks URLs in their encoded form, while the browser interprets them in their decoded form. This fundamental mismatch between the validation context and the execution context creates an exploitable gap.

The IsDangerousURL function performs a simple string prefix comparison without first normalizing the input by resolving HTML entities. This oversight allows any dangerous protocol scheme to be obfuscated using HTML5 named character references (such as :, ;, <, etc.).

Attack Vector

The attack vector is network-based and requires user interaction. An attacker must craft malicious Markdown content containing encoded JavaScript URLs and convince a victim to view the rendered content. Typical attack scenarios include:

The vulnerability can be exploited by submitting malicious Markdown content through comment systems, forum posts, documentation platforms, wikis, or any web application that renders user-supplied Markdown using the vulnerable Goldmark component. When another user views the rendered content, the obfuscated JavaScript URL bypasses server-side sanitization and executes in their browser context.

Example payloads that bypass the filter include variations such as javascript:alert(document.cookie) or javascript:alert(1) where the colon character is replaced with its HTML entity equivalent.

Detection Methods for CVE-2026-5160

Indicators of Compromise

• Presence of HTML entity-encoded URL schemes in Markdown content (e.g., :, :, :)
• Unusual patterns combining protocol names with HTML entities in user-submitted content
• Client-side JavaScript errors or unexpected script execution reports from users
• Web Application Firewall (WAF) logs showing encoded JavaScript patterns in POST requests

Detection Strategies

• Implement content scanning rules to detect HTML entity patterns adjacent to known dangerous protocol names
• Monitor application logs for Markdown submissions containing character reference patterns like :, :, or :
• Deploy browser-based XSS detection using Content Security Policy (CSP) violation reporting
• Review dependency manifests to identify applications using Goldmark versions below 1.7.17

Monitoring Recommendations

• Enable verbose logging for Markdown rendering operations to capture input patterns
• Configure CSP headers with report-uri directive to receive real-time XSS attempt notifications
• Implement periodic Software Composition Analysis (SCA) scans to identify vulnerable Goldmark dependencies
• Monitor client-side error reporting services for unexpected JavaScript execution events

How to Mitigate CVE-2026-5160

Immediate Actions Required

• Upgrade github.com/yuin/goldmark to version 1.7.17 or later immediately
• Review and audit all applications using Goldmark for Markdown processing
• Implement Content Security Policy (CSP) headers as a defense-in-depth measure
• Consider temporarily disabling link rendering in Markdown if immediate patching is not possible

Patch Information

The vulnerability has been addressed in Goldmark version 1.7.17. The fix ensures that HTML entity resolution occurs before URL validation, preventing the bypass technique. The patch is available via the GitHub commit.

To update your Go application, run:

go get github.com/yuin/goldmark@v1.7.17

Additional vulnerability details are available in the Snyk Vulnerability Report.

Workarounds

• Implement server-side HTML entity decoding before passing URLs to the Goldmark renderer
• Deploy a secondary URL validation layer that operates on decoded/normalized URLs
• Use Content Security Policy headers to restrict inline script execution (script-src 'self')
• Consider using an allowlist approach for URL schemes rather than a blocklist

# Example: Update Go module dependency
go get github.com/yuin/goldmark@v1.7.17
go mod tidy

# Verify the installed version
go list -m github.com/yuin/goldmark