An attacker can exploit the golang.org/x/net/html parser by injecting duplicate attributes into HTML input. This causes the parser to build an unexpected tree that retains malicious script elements, allowing the rendered content to execute client‑side code in a victim’s browser.

The vulnerability affects the golang.org/x/net/html package from the Go standard library. No specific product versions are listed in the CNA data, so any deployment using this package before the fix is potentially impacted. Users must verify the version of the package they are running and upgrade to the latest release once it contains the remediation.

The exploit requires that an application parse user‑controlled HTML with Render. The CVSS score of 6.1 indicates a high severity level for this flaw. While the EPSS score is unavailable and the CVE is not in the CISA KEV catalog, the inherent risk of XSS remains significant, particularly for web applications that rely on this parser for user‑generated content. The likely attack vector is through any form or API that accepts raw HTML input and renders it without additional sanitization. Administrators should assess whether the application exposes a pathway for such input and consider the severity of a potential XSS failure in their environment.