GitHub Advisoryadvisory · Go

GHSA-vvgc-356p-c3xw golang.org/x/net vulnerable to Cross-site Scripting

MEDIUM Published 2025-04-16 Modified 2025-05-17 Official page ↗
Aliases
CVE-2025-22872
Ecosystem
Go
Packages
golang.org/x/net
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Weaknesses
CWE-79
Reviewed
2025-04-16

Affected packages

• Go golang.org/x/net: < 0.38.0 → fixed in 0.38.0

Description

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. , , etc contexts).

Related

Alias · CVE (1)

  • CVE-2025-22872 The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References