Repository navigation
x/net/html: duplicate attributes can cause XSS #79575
Description
The HTML parser did not properly handle multiple duplicate attributes, causing
the parser to misparse certain HTML trees. This can cause XSS when rendering
parsed HTML.
Thanks to ensy for reporting this issue.
This is CVE-2026-27136 and Go issue https://go.dev/issue/79575.
This was a PRIVATE track issue, tracked in http://b/482232950.
Activity
[-]security: fix CVE-2026-27136[/-][+]html: duplicate attributes can cause XSS[/+][-]html: duplicate attributes can cause XSS[/-][+]x/net/html: duplicate attributes can cause XSS[/+]upgraded golang.org/x/net v0.53.0 => v0.55.0
upgraded golang.org/x/net v0.53.0 => v0.55.0
Upgrade `golang.org/x/` dependencies to address vulnerabilities (#311)