Golang HTML Parser Duplicate Attributes Leading to Cross-Site Scripting Vulnerability

A cross-site scripting (XSS) vulnerability has been identified in the HTML parser of the Golang x/net package, prior to version 0.55.0. The issue arises from the parser's improper handling of duplicate attributes, which can lead to an unexpected HTML structure. When such misparsed HTML is rendered, it can bypass sanitization efforts and execute XSS attacks.

Impact

Exploitation of this vulnerability allows for cross-site scripting attacks, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Remediation

Users can upgrade to version 0.55.0 or later of the golang.org/x/net package to address this vulnerability.