A flaw in golang.org/x/net/html allows character references in a DOCTYPE to be misinterpreted, producing an altered HTML tree that can contain arbitrary JavaScript when rendered by the Render function. This enables client‑side script execution in the vulnerable application, which can be used for phishing, defacement or credential theft.

Any Go application that imports golang.org/x/net/html and uses its Render routine to display or sanitize user‑supplied HTML is affected. No specific version exclusions are noted, so all current releases that have not yet been patched should be treated as vulnerable until a corrected release is available.

The CVSS score is 6.1 and the EPSS score is < 1%, indicating a very low but nonzero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote submission of malicious HTML through any input channel that is parsed and rendered by the library, enabling XSS attacks that affect the client and expose contextual information such as cookies or local storage.