Go x/net/html CVE-2026-25681

The affected component is golang.org/x/net/html (CPE: cpe:2.3:a:golang.org/x/net:golang.org/x/net/html:*:*:*:*:*:*:*:*), the Go extended standard library's HTML5 parsing package, maintained by the Go team. The root cause is classified as CWE-1021 (Improper Restriction of Rendered UI Layers or Frames), which here manifests as a parser-differential or mutation XSS (mXSS) condition: the library's Render function reconstructs an HTML string from a parsed tree, but under certain inputs the resulting serialization, when re-parsed - as a browser will do - produces a different DOM tree than was originally sanitized. This is a well-documented class of vulnerability in HTML sanitizers: if the sanitizer's parser and the browser's parser disagree on how to construct a tree from the same markup, a sanitizer can pass content it believes is clean, only for the renderer to interpret it as executable script. The issue is tracked upstream at go.dev/issue/79574 and the fix is in CL 781703.