An attacker can exploit the golang.org/x/net/html parser by injecting duplicate attributes into HTML input. This causes the parser to build an unexpected tree that retains malicious script elements, allowing the rendered content to execute client‑side code in a victim’s browser.

The vulnerability affects the golang.org/x/net/html package from the Go standard library. No specific product versions are listed in the CNA data, so any deployment using this package before the fix is potentially impacted. Users must verify the version of the package they are running and upgrade to the latest release once it contains the remediation.

This exploit requires that an application parse user‑controlled HTML with Render. The CVSS score of 6.1 indicates a moderate severity level for this flaw. The EPSS score of < 1% indicates a very low probability that this vulnerability will be actively exploited in the wild at this time. The inherent risk of XSS remains significant for web applications that rely on this parser for user‑generated content. The likely attack vector is through any form or API that accepts raw HTML input and renders it without additional sanitization. Administrators should assess whether the application exposes a pathway for such input and consider the severity of a potential XSS failure in their environment.