Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 0.62.0
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The golang.org/x/net Go library's HTML rendering code is affected. Under certain nested markup, the rendered output can be parsed differently when read back, which may lead to unintended HTML structure and content.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as <mglyph> or <malignmark> fostered under <mtext>), causing a parser to resolve the subtree in a different foreign namespace upon re-parsing the rendered output. Continue walking the full ancestor chain and verify that every transition from a non-empty namespace occurs at an HTML integration point before emitting literal text.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- golang.org/x/net/html
fixed in 0.62.0
- golang.org/x/netGo
fixed in 0.62.0