CVE-2026-42502: 
cAdvisor vulnerability analysis and mitigation

CVE-2026-42502 is a cross-site scripting (XSS) vulnerability in the Go golang.org/x/net/html package that arises when parsing arbitrary HTML and subsequently rendering it with the Render function, producing an unexpected HTML tree. This flaw can be exploited to bypass HTML sanitization routines in applications that parse and then re-render user-supplied HTML before display. All versions of golang.org/x/net prior to 0.55.0 are affected. The vulnerability was published on May 22, 2026, and carries a CVSS v3.1 base score of 6.1 (Medium) (Go Vuln DB, golang-announce).

The root cause is classified as CWE-1021 (Improper Restriction of Rendered UI Layers or Frames), stemming from a discrepancy between how the Go HTML parser constructs an internal tree from arbitrary HTML and how the Render function serializes that tree back to HTML. When an application uses the Go html package to parse untrusted input for sanitization and then calls Render to produce output, the round-trip can yield a structurally different HTML document than what was sanitized, allowing injected script content to survive the sanitization step. The attack vector is network-based, requires no privileges, and requires user interaction (a victim must view the rendered content). The fix is tracked in the Go issue tracker and code review system (Go Issue, Go CL, Go Vuln DB).

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary JavaScript in the context of a victim's browser session, enabling session cookie theft, authentication token forgery, and unauthorized actions performed on behalf of the victim. The scope is changed (cross-origin impact), with low confidentiality and low integrity impact and no availability impact. Applications that rely on the Go html package for sanitization — such as web applications, content management systems, or API gateways built in Go — are at risk if they parse and re-render user-supplied HTML (Go Vuln DB, golang-announce).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of this report. The EPSS score is approximately 0.031%, indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Go Vuln DB).

1. Identify a vulnerable target: Find a Go web application that uses golang.org/x/net/html (versions < 0.55.0) to parse user-supplied HTML for sanitization and then calls Render to produce output displayed to other users (e.g., a comment system, rich-text editor, or content preview feature).
2. Craft a malicious HTML payload: Construct an HTML snippet that, when parsed by the Go HTML parser, produces a sanitized-looking tree, but when serialized back via Render, results in an HTML structure containing executable JavaScript (e.g., exploiting parser/serializer discrepancies with malformed tags, namespace confusion, or attribute ordering).
3. Submit the payload: Inject the crafted HTML through the application's input mechanism (e.g., a form field, API endpoint, or file upload) that feeds into the parse-sanitize-render pipeline.
4. Trigger victim rendering: Wait for or socially engineer a victim user to view the page or content where the rendered output is displayed.
5. Execute XSS: The victim's browser executes the injected JavaScript, allowing the attacker to steal session cookies, exfiltrate data, or perform actions as the victim (Go Issue, Go Vuln DB).

• Logs: Unexpected or malformed HTML content in application input logs containing script tags, event handlers (onerror, onload, etc.), or JavaScript URIs (javascript:) that survived sanitization; server-side errors or panics in the Go HTML parsing/rendering pipeline.
• Network: Outbound requests from victim browsers to attacker-controlled domains shortly after viewing user-generated content; unusual document.cookie exfiltration patterns in web proxy logs.
• Application Behavior: Reports from users of unexpected JavaScript execution or redirects when viewing content submitted by other users; anomalous content appearing in rendered HTML output that differs from stored/sanitized input.

The primary remediation is to upgrade golang.org/x/net to version 0.55.0 or later, which contains the fix for this vulnerability (Go Vuln DB, Go CL). As interim mitigations, implement strict Content Security Policy (CSP) headers to restrict JavaScript execution, and consider using a dedicated, well-maintained HTML sanitization library rather than relying solely on the Go html package's parse-render round-trip. Ensure output encoding is applied consistently and test sanitization logic against known XSS payloads and HTML parser edge cases. SUSE has issued security updates for affected packages in their distributions (SUSE Advisory).

The Go security team disclosed the vulnerability via the golang-announce mailing list and published a fix through the standard Go vulnerability database (golang-announce). SUSE and openSUSE issued security advisories and package updates for their distributions. The rclone project noted the dependency update in its changelog. No significant independent researcher commentary or broad media coverage has been identified beyond routine vulnerability tracking.