Medium severity · published May 22, 2026
CVE-2026-27136
Invoking duplicate attributes can cause XSS in golang.org/x/net/html
6.1
CVSS
0.2%
EPSS
No
On KEV
Description
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 13% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GO
golang.org/x/net/html · golang.org/x/net
before 0.55.0 · source: vendor
NE
Net · Golang
before 0.55.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-27136
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-27136
Issue Tracking
https://go.dev/cl/781685
Issue Tracking
https://go.dev/issue/79575
Mailing List
https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8
Vendor Advisory
https://pkg.go.dev/vuln/GO-2026-5030
More from golang.org/x/net/html
6.5
CVE-2026-25680
Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html
6.1
CVE-2026-25681
Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
6.1
CVE-2026-42502
Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
6.1
CVE-2026-42506
Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html
5.3
CVE-2025-58190
Infinite parsing loop in golang.org/x/net