Path Traversal in Go HTML Renderer

Publication date: 2026-10-27

Last updated on: 2026-10-27

Assigner: Go Project

Description

In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as <mglyph> or <malignmark> fostered under <mtext>), causing a parser to resolve the subtree in a different foreign namespace upon re-parsing the rendered output. Continue walking the full ancestor chain and verify that every transition from a non-empty namespace occurs at an HTML integration point before emitting literal text.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-27

Last Modified

2026-10-27

Generated

2026-10-28

AI Q&A

2026-10-28

EPSS Evaluated

N/A

NVD

CVE-2026-97045

EUVD

EUVD-2026-111400

Affected Vendors & Products

Vendor	Product	Version / Range
golang.org/x/net	golang.org/x/net/html	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability involves a parser issue where walking up the tree stops prematurely at an HTML integration point. However, the integration point itself might be a descendant of an element foster-parented into a foreign namespace, causing incorrect namespace resolution when re-parsing rendered output.

Impact Analysis

This could lead to incorrect parsing of HTML content, potentially causing security issues like injection or rendering problems if the parser misinterprets the namespace of elements.

Hi! I’m here to help you understand CVE-2026-97045. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70