CVE-2026-97045
golang.org/x/net/html: Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net
golang.org/x/net golang.org/x/net/html
CVSS
NoneNot scoredExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
What fixes it
- 0.62.0golang.org/x/net/htmlCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as <mglyph> or <malignmark> fostered under <mtext>), causing a parser to resolve the subtree in a different foreign namespace upon re-parsing the rendered output. Continue walking the full ancestor chain and verify that every transition from a non-empty namespace occurs at an HTML integration point before emitting literal text.
Text from CVE List
Affected versions 1
- golang.org/x/net/htmlaffected: all versions before 0.62.0CVE List