Parsing arbitrary HTML with golang.org/x/net/html that is subsequently rendered via Render can produce an unexpected DOM structure. Attackers can exploit this to inject malicious scripts into web pages that believe they have sanitized input, leading to client‑side code execution. This vulnerability allows cross‑site scripting, potentially compromising user sessions, leaking sensitive data, or performing actions on behalf of the user.

The affected product is golang.org/x/net, specifically the golang.org/x/net/html package. No specific version constraints are documented in the CVE, so any application that imports this package and renders HTML using Render is potentially impacted.

The CVSS score is 6.1, indicating medium severity, and EPSS information is unavailable, so the exploitation probability is not quantified. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be local or remote depending on how the library is used; if a web application incorporates this HTML parser to clean or render user input, an attacker with ability to supply that input could trigger XSS. Exploitation requires that the application trusts the rendered output, so steps to verify sanitization or bypass are necessary.