← Vulnerability feed

Vulnerability record · CVE-2026-27136 · published 22 May 2026

CVE-2026-27136: Golang net clickjacking vulnerability

Golang · Net

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

6.1 CVSS 3.1 Medium EPSS 0.22% · top 88.3% CWE-1021 · Clickjacking
6.1CVSS 3.1 base score
0.22%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
23 Jul 2026Last modified by NVD

Description

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://go.dev/cl/781685 Issue Tracking
https://go.dev/issue/79575 Issue Tracking
https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8 Mailing List
https://pkg.go.dev/vuln/GO-2026-5030 Vendor Advisory

Track CVE-2026-27136 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.6CVE-2026-39821Golang net vulnerabilityThe ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--exampl…EPSS 0.69%7.5CVE-2018-17846Golang net vulnerabilityThe html package (aka x/net/html) through 2018-09-25 in Go mishandles <table><math><select><mi><select></table>, leading to an infinite loop during a…EPSS 2.5%7.5CVE-2018-17847Golang net memory buffer overflow vulnerabilityThe html package (aka x/net/html) through 2018-09-25 in Go mishandles <svg><template><desc><t><svg></template>, leading to a "panic: runtime error" (…EPSS 2.4%7.5CVE-2018-17848Golang net vulnerabilityThe html package (aka x/net/html) through 2018-09-25 in Go mishandles <math><template><mn><b></template>, leading to a "panic: runtime error" (index …EPSS 2.2%7.5CVE-2018-17142Golang net null pointer dereference vulnerabilityThe html package (aka x/net/html) through 2018-09-17 in Go mishandles <math><template><mo><template>, leading to a "panic: runtime error" in parseCur…EPSS 2.4%7.5CVE-2018-17143Golang net memory buffer overflow vulnerabilityThe html package (aka x/net/html) through 2018-09-17 in Go mishandles <template><tBody><isindex/action=0>, leading to a "panic: runtime error" in inB…EPSS 2.8%7.5CVE-2018-17075Golang net null pointer dereference vulnerabilityThe html package (aka x/net/html) before 2018-07-13 in Go mishandles "in frameset" insertion mode, leading to a "panic: runtime error" for html.Parse…EPSS 2.8%6.5CVE-2026-25680Golang net uncontrolled resource consumption vulnerabilityParsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.EPSS 0.46%

Source: NIST National Vulnerability Database (record CVE-2026-27136), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.