CVE-2026-27136: 
cAdvisor vulnerability analysis and mitigation

CVE-2026-27136 is a cross-site scripting (XSS) vulnerability in the golang.org/x/net/html package (Go's extended networking library) that allows unauthenticated attackers to bypass HTML sanitization and execute arbitrary JavaScript in a victim's browser. The flaw arises when parsing arbitrary HTML that is subsequently rendered using the Render function, producing an unexpected HTML tree that circumvents sanitization logic. All versions of golang.org/x/net prior to 0.55.0 are affected. The vulnerability was published on May 22, 2026, and carries a CVSS v3.1 base score of 6.1 (Medium) (pkg.go.dev, golang-announce).

The root cause is classified as CWE-1021 (Improper Restriction of Rendered UI Layers or Frames) and stems from a mismatch between how the golang.org/x/net/html parser constructs the internal HTML tree and how the Render function serializes it back to HTML. Specifically, invoking duplicate attributes during parsing can cause the resulting HTML tree to differ from what was originally parsed, meaning that a sanitizer operating on the parsed tree may not catch malicious payloads that survive the round-trip through Render. An attacker crafts malicious HTML input containing duplicate or specially structured attributes; when an application parses this input for sanitization and then re-renders it, the output HTML may contain executable script content that was not present in the sanitized representation. The issue is tracked upstream as Go issue #79575 and fixed in commit a452f3cc (pkg.go.dev, golang-announce).

Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript in the context of a victim user's browser session, impacting both confidentiality (e.g., session token theft, credential harvesting) and integrity (e.g., DOM manipulation, phishing overlays), with no availability impact. The vulnerability is particularly dangerous for applications that rely on golang.org/x/net/html as their primary HTML sanitization mechanism before rendering user-supplied content, as the sanitization bypass is transparent to the application. Scope is changed (per the CVSS vector), meaning the impact can extend beyond the vulnerable component to affect the user's browser environment (pkg.go.dev, golang-announce).

As of the time of this report, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (pkg.go.dev). The vulnerability requires user interaction (a victim must render the attacker-supplied HTML in their browser) and is network-accessible with no privileges required. The EPSS score is approximately 0.031%, indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection coverage exists via Nessus (plugin 317705) and Qualys (plugin 762973).

1. Identify a target application: Find a web application built with Go that uses golang.org/x/net/html (versions < 0.55.0) to parse and sanitize user-supplied HTML before rendering it to other users (e.g., a comment system, rich-text editor, or email preview feature).
2. Craft malicious HTML with duplicate attributes: Construct an HTML payload that exploits the parser/renderer mismatch — for example, by including duplicate attributes on an element that cause the sanitizer to see a benign tree but the renderer to output executable script content (e.g., <p id="x" id="onmouseover=alert(1)">).
3. Submit the payload: Inject the crafted HTML through the application's input mechanism (e.g., a form field, API endpoint, or file upload) that feeds into the Go HTML parsing/sanitization pipeline.
4. Trigger rendering: Cause a victim user to load the page or content where the attacker-supplied HTML is rendered — the Render function outputs the unexpected HTML tree, bypassing the sanitizer's checks.
5. Execute XSS: The victim's browser executes the injected JavaScript, enabling session hijacking, credential theft, or further attacks (pkg.go.dev, infinitsec).

• Logs: Web server or application logs showing unusual HTML input containing duplicate attributes or malformed tag structures submitted to input fields that accept HTML content.
• Network: Outbound requests from victim browsers to attacker-controlled domains following rendering of user-supplied HTML content (indicative of XSS payload execution, e.g., cookie exfiltration via document.cookie).
• Application Behavior: Unexpected JavaScript execution or DOM modifications reported by users on pages that render user-supplied HTML; Content Security Policy (CSP) violation reports referencing inline scripts or unexpected external origins.
• File System: If the application logs parsed/rendered HTML, discrepancies between the sanitized input and the rendered output HTML containing <script> tags or event handler attributes (on*) may indicate exploitation attempts.

The primary remediation is to upgrade golang.org/x/net to version 0.55.0 or later, which contains the fix for this vulnerability (pkg.go.dev, golang-announce). If immediate patching is not feasible, implement defense-in-depth measures: deploy Content Security Policy (CSP) headers to restrict inline script execution, apply output encoding at the rendering layer, and add a secondary HTML sanitization library that does not rely solely on golang.org/x/net/html for security decisions. Applications should never treat the parse→sanitize→render pipeline as a security boundary without validating the final rendered output. SUSE has issued security updates for affected packages in its ecosystem (SUSE Advisory).

The Go security team disclosed the vulnerability via the official golang-announce mailing list and published a detailed advisory on pkg.go.dev (golang-announce, pkg.go.dev). Security researcher coverage appeared on Infinitsec, which published a technical write-up specifically noting the duplicate-attributes mechanism as the trigger (infinitsec). Downstream vendors including SUSE and openSUSE issued security advisories and package updates, and projects such as rclone updated their dependencies to address the flaw (SUSE Advisory, rclone). Community reaction has been measured, consistent with the Medium severity rating and absence of active exploitation.