Unscored severity · published Oct 27, 2026
CVE-2026-97045
Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net
New
–
CVSS
–
EPSS
No
On KEV
Description
In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as <mglyph> or <malignmark> fostered under <mtext>), causing a parser to resolve the subtree in a different foreign namespace upon re-parsing the rendered output. Continue walking the full ancestor chain and verify that every transition from a non-empty namespace occurs at an HTML integration point before emitting literal text.
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GO
golang.org/x/net/html · golang.org/x/net
before 0.62.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-97045
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-97045
go.dev
https://go.dev/cl/855121
go.dev
https://go.dev/issue/82622
groups.google.com
https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs
pkg.go.dev
https://pkg.go.dev/vuln/GO-2026-6866
More from golang.org/x/net/html
6.5
CVE-2026-25680
Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html
6.1
CVE-2026-27136
Invoking duplicate attributes can cause XSS in golang.org/x/net/html
6.1
CVE-2026-25681
Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
6.1
CVE-2026-42502
Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
6.1
CVE-2026-42506
Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html
