{"schema":"threatline.record/2","record":{"id":"CVE-2026-97045","aliases":[],"summary":"Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net","details":"In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as <mglyph> or <malignmark> fostered under <mtext>), causing a parser to resolve the subtree in a different foreign namespace upon re-parsing the rendered output. Continue walking the full ancestor chain and verify that every transition from a non-empty namespace occurs at an HTML integration point before emitting literal text.","categories":["Unclassified"],"product":"golang.org/x/net/html","vendor":"golang.org/x/net","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97045","source_modified_at":"2026-10-27T21:38:56.700Z","fetched_at":"2026-10-28T01:10:53.534015Z","product":"golang.org/x/net/html","vendor":"golang.org/x/net","versions":[{"version":"0","lessThan":"0.62.0","status":"affected","versionType":"semver"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97045","source_modified_at":"2026-10-27T21:38:56.700Z","fetched_at":"2026-10-28T01:10:53.534015Z","package":{"name":"golang.org/x/net/html","ecosystem":null},"version":"0.62.0","basis":"first unaffected version stated in the CVE record"}],"cvss":null,"severity":null,"kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-27T21:38:56.700Z","modified_at":"2026-10-27T21:38:56.700Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-97045","fetched_at":"2026-10-28T01:10:53.534015Z","source_modified_at":"2026-10-27T21:38:56.700Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://go.dev/cl/855121"},{"source":"CVE List","url":"https://go.dev/issue/82622"},{"source":"CVE List","url":"https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs"},{"source":"CVE List","url":"https://pkg.go.dev/vuln/GO-2026-6866"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-27T21:38:56.700Z","content_hash":"5bff4322958969187865dce3859834502b49941b26670bc77002386a0b2de828"}}