—

GO-2026-5029

Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html

Quick fix

GO-2026-5029 — golang.org/x/net: upgrade to the fixed version with the command below.

go get golang.org/x/net@v0.55.0

Details

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go / golang.org/x/net

Introduced in: 0 Fixed in: 0.55.0

Fix go get golang.org/x/net@v0.55.0

References

https://go.dev/issue/79574 [REPORT]
https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8 [WEB]
https://go.dev/cl/781703 [FIX]