Unscored severity · published Oct 27, 2026
CVE-2026-97045
Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net
New
–
CVSS
–
EPSS
No
On KEV
Description
In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as <mglyph> or <malignmark> fostered under <mtext>), causing a parser to resolve the subtree in a different foreign namespace upon re-parsing the rendered output. Continue walking the full ancestor chain and verify that every transition from a non-empty namespace occurs at an HTML integration point before emitting literal text.
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GO
golang.org/x/net/html · golang.org/x/net
before 0.62.0 · source: vendor
Affected product
GO
golang.org/x/net/html
golang.org/x/net
More from golang.org/x/net/html
6.5
CVE-2026-25680
Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html
6.1
CVE-2026-27136
Invoking duplicate attributes can cause XSS in golang.org/x/net/html
6.1
CVE-2026-25681
Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
6.1
CVE-2026-42502
Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
6.1
CVE-2026-42506
Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html