Go x/net/html CVE-2026-42502

The affected component is the golang.org/x/net/html package (CPE: cpe:2.3:a:golang.org/x/net:golang.org/x/net/html:*:*:*:*:*:*:*:*), Go's extended HTML parsing and rendering library. The root cause is classified as CWE-1021 (Improper Restriction of Rendered UI Layers or Frames), reflecting a parse-render mismatch: the parser constructs an HTML tree that, when serialized back via Render, produces structurally different HTML than what was originally parsed. This is the classic mutation XSS (mXSS) class of vulnerability. Applications commonly use this package in a sanitize-then-render pipeline: parse untrusted HTML, walk the tree to remove dangerous nodes, then render back to a string for display. Because the Render output can differ structurally from the parsed input, a sanitizer may inspect a safe tree while the rendered output re-introduces executable content the sanitizer never saw.