CVE-2026-42506: 
cAdvisor vulnerability analysis and mitigation

CVE-2026-42506 is a Cross-Site Scripting (XSS) vulnerability in Go's golang.org/x/net/html package that allows unauthenticated attackers to bypass HTML sanitization and execute arbitrary JavaScript in a victim's browser. The flaw arises because parsing arbitrary HTML with the package's parser and then rendering it with Render can produce an unexpected HTML tree that differs from what a sanitizer inspected. All versions of golang.org/x/net prior to 0.55.0 are affected. It was published on May 22, 2026, with a patch released on May 29, 2026, and carries a CVSS v3.1 base score of 6.1 (Medium) (Go Vuln DB, golang-announce).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The vulnerability stems from a discrepancy between how Go's HTML parser constructs the internal DOM tree and how the Render function serializes it back to HTML: a sanitizer that inspects the parsed tree may see a safe structure, but the rendered output can differ, allowing malicious script content to survive sanitization. The attack vector is network-based, requires no privileges, and requires user interaction (a victim must view the crafted content). The fix is tracked in the Go issue tracker and applied via commit to the golang/net repository (Go Issue, Go CL, Go Vuln DB).

Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript in the context of a victim user's browser session, enabling session token theft, account takeover, unauthorized actions performed on behalf of the user, and access to sensitive information visible within the application. The scope is changed (C:L/I:L/A:N in CVSS terms), meaning the impact crosses the security boundary of the originating application into the user's browser context. Availability is not directly impacted, but confidentiality and integrity are both affected at a low level per individual exploitation, with potential for broader harm through chained attacks (Go Vuln DB, golang-announce).

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation. The EPSS score is approximately 0.031%, indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection plugins are available from Nessus (plugin IDs 316807, 317707) and Qualys (762973) (Go Vuln DB).

1. Identify a vulnerable application: Find a Go-based web application that uses golang.org/x/net < 0.55.0 to parse and sanitize user-supplied HTML before rendering it back to users.
2. Craft a parser-confusing HTML payload: Construct an HTML snippet that, when parsed by Go's HTML parser, appears benign to a sanitizer inspecting the parse tree, but when serialized back via Render, produces output containing an executable script (e.g., exploiting namespace or context confusion in the parser).
3. Submit the payload: Inject the crafted HTML through any user-controlled input field that the application processes with the vulnerable parse-then-sanitize-then-render pipeline (e.g., a comment field, profile bio, or rich-text editor).
4. Trigger victim interaction: Deliver a link or cause the victim to navigate to the page where the rendered (unsanitized) output is displayed.
5. Execute malicious script: The victim's browser executes the injected JavaScript, allowing the attacker to steal session cookies, perform CSRF-style actions, or exfiltrate sensitive page content (Go Issue, Go Vuln DB).

• Logs: Web server access logs showing unusual or encoded HTML payloads in POST request bodies to input-accepting endpoints; application error logs showing unexpected HTML rendering output.
• Network: Outbound requests from a victim's browser to attacker-controlled domains (e.g., for cookie exfiltration) originating from pages that render user-supplied HTML content.
• Application Behavior: Reports from users of unexpected script execution or redirects on pages that display user-generated content processed by the Go net/html package.

The primary remediation is to upgrade golang.org/x/net to version 0.55.0 or later, which contains the fix for the HTML parse/render discrepancy (Go Vuln DB, golang-announce). As additional defense-in-depth measures, implement Content Security Policy (CSP) headers to restrict script execution, use a well-maintained and separately validated HTML sanitization library rather than relying solely on parse-tree inspection, and consider templating engines with automatic output encoding. SUSE has issued security updates for affected packages in its ecosystem (SUSE Advisory).

The Go security team disclosed the vulnerability via the golang-announce mailing list and published a detailed entry in the Go vulnerability database. SUSE issued multiple security announcements addressing the vulnerability in downstream packages. The rclone project noted the dependency update in its changelog. No significant independent researcher commentary or broad media coverage has been identified beyond standard vulnerability tracking and vendor patch notifications (golang-announce, SUSE Advisory, rclone Changelog).