ZeroDay Findings
Sign inSign up

Findings

CVE-2026-25681

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree.

Published May 22, 2026 · updated Jul 23, 2026 · golang net

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. May 22, 2026 · NIST NVD

    Detected

    Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

  2. Jul 23, 2026 · NIST NVD

    Updated

    Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Affected

  • cpe golang/netversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-25681

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-25681

    Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

    nvd.nist.gov

References