{"id":"CVE-2026-97045","kind":"vulnerability","aliases":["CVE-2026-97045","GO-2026-6866"],"related":[],"title":"Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net","description":"In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as <mglyph> or <malignmark> fostered under <mtext>), causing a parser to resolve the subtree in a different foreign namespace upon re-parsing the rendered output.\n\nContinue walking the full ancestor chain and verify that every transition from a non-empty namespace occurs at an HTML integration point before emitting literal text.","summary":"The golang.org/x/net HTML renderer could emit raw text whose ancestor namespace transitions were not fully checked, so re-parsing the output puts the subtree in a different foreign namespace. The sources do not state the concrete impact an attacker gets from this namespace confusion.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"golang.org/x/net","fixed":["0.62.0"],"affected":"< 0.62.0","ecosystem":"go"}],"ecosystems":["go"],"tags":["go","golang-services","golang.org/x/net","package"],"not_affected_if":["html-package-unused","no-reparse-of-rendered-output"],"how_to_check":"- Run `go list -m golang.org/x/net` in the project and check whether the version is below `0.62.0`\n- Run `go list -m -json golang.org/x/net` to confirm the resolved version in the module graph\n- Check whether the application renders untrusted HTML through golang.org/x/net/html and re-parses the output","fix":"- Upgrade golang.org/x/net to `0.62.0` or later with `go get golang.org/x/net@v0.62.0` and then `go mod tidy`","status":"open","published_at":"2026-10-27T21:16:18+00:00","first_seen_at":"2026-10-27T22:19:32+00:00","triaged_at":"2026-10-27T22:19:54+00:00","updated_at":"2026-10-27T22:19:54+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-27T22:19:54Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade golang.org/x/net to `0.62.0` or later with `go get golang.org/x/net@v0.62.0` and then `go mod tidy`","reach":"unknown","title":"golang.org/x/net: HTML rendering of raw text can be reparsed into a different namespace","impact":"medium","summary":"The golang.org/x/net HTML renderer could emit raw text whose ancestor namespace transitions were not fully checked, so re-parsing the output puts the subtree in a different foreign namespace. The sources do not state the concrete impact an attacker gets from this namespace confusion.","category":"package","nicknames":[],"who_cares":["go","golang.org/x/net","golang-services"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown; sources do not state the impact","analyst_note":"Check the GO-2026-6866 entry at https://pkg.go.dev/vuln/GO-2026-6866 for the concrete impact and exploit conditions.","how_to_check":"- Run `go list -m golang.org/x/net` in the project and check whether the version is below `0.62.0`\n- Run `go list -m -json golang.org/x/net` to confirm the resolved version in the module graph\n- Check whether the application renders untrusted HTML through golang.org/x/net/html and re-parses the output","needs_analyst":true,"not_affected_if":["html-package-unused","no-reparse-of-rendered-output"],"who_is_affected":"Applications that use golang.org/x/net/html to render parsed HTML back to text or markup and then parse that output again are exposed. Programs that only parse HTML, or that never re-parse rendered output, are unlikely to be affected. Teams that do not use the html package of golang.org/x/net can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000666,"input_tokens":3425,"output_tokens":647,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':17A,20A,23A '-6866':21A '-97045':18A,24A '/x/net':15A,27A,34B,39B 'ancestor':3A,47B,95C,152C 'attack':77B 'caus':129C 'chain':153C 'check':1A,53B 'childtextnodesareliter':84C 'concret':74B 'confus':82B 'continu':148C 'could':42B 'cve':16A,22A 'descend':111C 'differ':65B,138C 'element':114C 'emit':43B,172C 'empti':163C 'everi':157C 'foreign':66B,94C,122C,139C 'foster':118C,127C 'foster-par':117C 'found':102C 'full':151C 'fulli':52B 'get':78B 'go':19A,28B 'golang':30B 'golang-servic':29B 'golang.org':14A,26A,33B,38B 'golang.org/x/net':13A,25A,32B,37B 'howev':103C 'html':11A,40B,98C,168C 'impact':75B 'integr':99C,105C,169C 'liter':173C 'may':107C 'namespac':4A,48B,67B,81B,123C,140C,164C 'nearest':93C 'non':162C 'non-empti':161C 'occur':165C 'output':59B,147C 'packag':35B 'parent':119C 'pars':57B,144C 'parser':131C 'point':100C,106C,170C 'previous':89C 'put':60B 'raw':8A,44B 're':56B,143C 're-pars':55B,142C 'render':7A,41B,146C 'resolv':133C 'servic':31B 'sourc':69B 'state':72B 'stop':90C 'subtre':62B,135C 'text':9A,45B,174C 'transit':5A,49B,158C 'tree':88C 'upon':141C 'verifi':155C 'walk':85C,149C 'whose':46B","nicknames":[],"mitigations":[],"who_affected":"Applications that use golang.org/x/net/html to render parsed HTML back to text or markup and then parse that output again are exposed. Programs that only parse HTML, or that never re-parse rendered output, are unlikely to be affected. Teams that do not use the html package of golang.org/x/net can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T21:16:18+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6866","url":"https://pkg.go.dev/vuln/GO-2026-6866","severity":null,"published_at":"2026-10-27T21:16:18+00:00","modified_at":"2026-10-27T21:16:18+00:00","first_seen_at":"2026-10-27T22:19:32+00:00","fetched_at":"2026-10-27T22:19:32+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-97045","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97045","severity":null,"published_at":"2026-10-27T22:19:22+00:00","modified_at":"2026-10-27T22:19:22+00:00","first_seen_at":"2026-10-27T22:29:29+00:00","fetched_at":"2026-10-27T22:29:29+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}