In the golang.org/x/net HTML parser, the childTextNodesAreLiteral routine stopped walking up the element tree when it encountered the nearest foreign ancestor after an HTML integration point. When that integration point itself was inside a foster-parented element in a different XML namespace, the parser would produce output that was parsed again as a different foreign namespace. The result is that literal text is emitted without verifying that every transition from a non-empty namespace occurs at an HTML integration point, which can cause unintended markup to be rendered. This flaw may enable an attacker who can influence the parser input to inject HTML or SVG elements that bypass normal namespace checks, leading to potential cross-site scripting or similar injection issues.

Affected systems include the golang.org/x/net/html package. The known CNA vendor/product is golang.org/x/net:golang.org/x/net/html. No specific affected version range is provided in the data, but the references point to a recent issue (go.dev/issue/82622) that contains the patch, indicating that newer releases of the package contain the fix.

There is no EPSS score or KEV listing for this vulnerability, so its exploitation likelihood is unknown but potentially low to moderate. The flaw resides in a library that may be used to render untrusted input into HTML, so an attacker could potentially deliver malicious content if the library is used without proper sanitization. The risk depends on whether the affected code processes untrusted data, but the absence of a public exploit at this time suggests a moderate to low severity, whereas the potential for content injection warrants immediate attention.