CVE-2026-97045: 
Gitea vulnerability analysis and mitigation

CVE-2026-97045 is an HTML parser namespace confusion vulnerability in the golang.org/x/net/html package that enables HTML injection or content manipulation through maliciously crafted input. The flaw exists in the childTextNodesAreLiteral function, where the tree-walking algorithm incorrectly stops at the nearest foreign ancestor upon finding an HTML integration point, without verifying the full ancestor chain. All versions of golang.org/x/net/html prior to 0.62.0 are affected. It was published on October 27, 2026, with a patch released the same day. The CVSS category is estimated as Medium, with an EPSS score of 0.0 (GitHub Advisory, EUVD).

The root cause is improper namespace resolution in the HTML parser's childTextNodesAreLiteral function (CWE-79, Cross-Site Scripting). When the parser walks up the DOM tree and encounters an HTML integration point, it previously halted without continuing to verify the full ancestor chain. An HTML integration point may itself be a descendant of an element foster-parented into a foreign namespace — such as <mglyph> or <malignmark> fostered under <mtext> — causing the parser to resolve the subtree in a different foreign namespace upon re-parsing the rendered output. The fix requires walking the complete ancestor chain and verifying that every transition from a non-empty namespace occurs at a valid HTML integration point before emitting literal text (GitHub Advisory, Go Vuln DB).

An unauthenticated attacker can craft malicious HTML that, when parsed and subsequently re-parsed, produces different output in a different namespace, enabling HTML injection or content manipulation attacks through namespace confusion. This primarily affects the integrity of rendered content in applications that use golang.org/x/net/html for parsing and re-serializing HTML, potentially allowing injection of arbitrary HTML elements or attributes. Confidentiality and availability impacts are considered low; the primary risk is content tampering and potential cross-site scripting in downstream applications (GitHub Advisory, Go Vuln DB).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date. The EPSS score is 0.0, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (GitHub Advisory, OSV).

The primary remediation is to upgrade golang.org/x/net to version 0.62.0 or later, which corrects the ancestor chain traversal logic in childTextNodesAreLiteral. If immediate patching is not feasible, operators should validate and sanitize all HTML input to prevent malicious namespace transitions and foster-parenting attacks, and implement strict output validation to detect unexpected namespace changes during parsing cycles. The fix is tracked under Go issue #82622 and code review CL 855121 (GitHub Advisory, Go Vuln DB).

The vulnerability was announced via the golang-announce mailing list and received routine coverage from vulnerability tracking services including OSV, VulnDB, and seclists.org/oss-sec. No notable researcher commentary or significant community debate has been observed beyond standard disclosure channels (golang-announce, oss-sec).