Golang HTML Parser XSS Vulnerability via DOCTYPE Character Reference Mismanagement

A cross-site scripting (XSS) vulnerability has been identified in the HTML parser of the Golang x/net/html package, prior to version 0.55.0. The issue arises from the parser's incorrect handling of character references in DOCTYPE nodes, leading to a distorted HTML tree. This flaw can be exploited in applications that sanitize HTML input before rendering, allowing for XSS attacks.

Impact

Exploitation of this vulnerability can lead to cross-site scripting (XSS) attacks, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Remediation

Users can upgrade to Golang x/net version 0.55.0 or later to address this vulnerability.