CVE-2026-42506

Description

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

CVSS Metrics

• v3.1•MEDIUM•Score: 6.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS Trends

Current EPSS score: 0.24%• Percentile: 15%

Techniques & Countermeasures

• CWE-79•Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

  The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Affected Systems

• chainguard•actions-runner-controller

  < 0

• chainguard•addon-resizer

  < 0

• chainguard•addon-resizer-fips

  < 0

• chainguard•agentbeat

  < 0

• chainguard•amass

  < 0

• chainguard•amazon-cloudwatch-agent-operator

  < 0

• chainguard•amazon-cloudwatch-agent-operator-fips

  < 0

• chainguard•amazon-ecs-agent

  < 0

• chainguard•amazon-ecs-agent-fips

  < 0

• chainguard•amazon-eks-ami

  < 0

• chainguard•amazon-eks-ami-fips

  < 0

• chainguard•amazon-k8s-cni

  < 0

• chainguard•amazon-k8s-cni-fips

  < 0

• chainguard•amazon-k8s-cni-init-fips-compat

  < 0

• chainguard•amazon-ssm-agent

  < 0

• chainguard•amazon-ssm-agent-ecs-exec

  < 0

• chainguard•amazon-ssm-agent-ecs-exec-fips

  < 0

• chainguard•amazon-ssm-agent-fips

  < 0

• chainguard•apache-exporter

  < 0

• chainguard•apko

  < 0

• chainguard•apko-fips

  < 0

• chainguard•apm-server-9.1

  all

• chainguard•apm-server-9.3

  < 0

• chainguard•apm-server-9.4

  < 0

• chainguard•apm-server-fips-9.1

  all

• chainguard•apm-server-fips-9.3

  < 0

• chainguard•apm-server-fips-9.4

  < 0

• chainguard•apply-cve-bump

  < 0

• chainguard•argo-cd-3.0

  all

• chainguard•argo-cd-3.0-compat

  all

• chainguard•argo-cd-3.1

  < 3.1.16-r3

• chainguard•argo-cd-3.1-compat

  < 3.1.16-r3

• chainguard•argo-cd-3.3-compat

  < 0

• chainguard•argo-cd-fips-3.0

  all

• chainguard•argo-cd-fips-3.0-compat

  all

• chainguard•argo-cd-fips-3.1

  < 3.1.16-r1

• chainguard•argo-cd-fips-3.1-compat

  < 3.1.16-r1

• chainguard•argo-events-fips

  < 0

• chainguard•argo-rollouts-fips

  < 0

• chainguard•argo-workflow-controller-3.6

  < 3.6.19-r7

• chainguard•argo-workflow-executor-3.6

  < 3.6.19-r7

• chainguard•argo-workflows-3.6

  < 3.6.19-r7

• chainguard•argocd-image-updater

  < 0

• chainguard•art

  < 0.2.268-r1

• chainguard•auditbeat-7

  all

• chainguard•auditbeat-8.19

  < 8.19.16-r2

• chainguard•auditbeat-9.3

  < 9.3.5-r2

• chainguard•auditbeat-fips-7

  all

• chainguard•authentik-2026.2-go-server

  < 0

• chainguard•authentik-fips-2025.12-go-server

  < 0

Showing first 50 affected entries in server-rendered view.

References (8)

• https://go.dev/issue/79571
• https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8
• https://go.dev/cl/781700
• https://pkg.go.dev/vuln/GO-2026-5025
• https://security-tracker.debian.org/tracker/CVE-2026-42506
• https://pkg.go.dev
• https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42506.json
• https://nvd.nist.gov/vuln/detail/CVE-2026-42506