Live › vulnerability › CVE-2026-97045
Go to dashboardThe golang.org/x/net HTML renderer could emit raw text whose ancestor namespace transitions were not fully checked, so re-parsing the output puts the subtree in a different foreign namespace. The sources do not state the concrete impact an attacker gets from this namespace confusion.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 22:19 UTC, 0h before NVD. All times on this page are UTC.
Applications that use golang.org/x/net/html to render parsed HTML back to text or markup and then parse that output again are exposed. Programs that only parse HTML, or that never re-parse rendered output, are unlikely to be affected. Teams that do not use the html package of golang.org/x/net can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| golang.org/x/net | go | < 0.62.0 | 0.62.0 |
go list -m golang.org/x/net in the project and check whether the version is below 0.62.0go list -m -json golang.org/x/net to confirm the resolved version in the module graph0.62.0 or later with go get golang.org/x/[email protected] and then go mod tidyEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as <mglyph> or <malignmark> fostered under <mtext>), causing a parser to resolve the subtree in a different foreign namespace upon re-parsing the rendered output.
Continue walking the full ancestor chain and verify that every transition from a non-empty namespace occurs at an HTML integration point before emitting literal text.
This page as .md · .json · in your agent: get_signal("CVE-2026-97045")
Go Vulnerability Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.