CVE-2025-22872
MediumCVSS 6.5Summary
The tokenizer incorrectly interprets tags with unquoted attribute values ending with a solidus character (/) as self-closing. When directly using Tokenizer, this can incorrectly mark such tags as self-closing, and when using Parse functions, content following such tags may be placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g., <math>, <svg> contexts).
Risk Assessment
Incorrect tag interpretation can lead to improper DOM construction, potentially enabling cross-site scripting (XSS) attacks or content manipulation in applications processing untrusted HTML. This particularly affects embedded content contexts such as MathML and SVG.
Recommendation
Update the library to a version containing the fix. Avoid processing untrusted HTML with vulnerable versions; consider additional input sanitization.
Other vulnerabilities in golang.org/x/net/html
See all- CVE-2025-47911Medium
The html.Parse function in golang.org/x/net/html has quadratic parsing complexity for specially crafted HTML inputs, which can lead to denial of service (DoS).
- CVE-2025-58190Medium
The html.Parse function in the golang.org/x/net/html package enters an infinite loop when processing specially crafted HTML input. An attacker can exploit this vulnerability to cause a denial of service (DoS).
Original NVD description (English source)
The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS