CVE-2026-42502
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
Risk Assessment
The risk involves the possibility of bypassing HTML sanitization mechanisms and executing malicious scripts in the user's browser, which could lead to data theft or session hijacking.
Recommendation
It is recommended to update the Render library to a version that properly handles unexpected HTML structures, and avoid relying solely on HTML sanitization before rendering.
Other vulnerabilities in Render
See all- CVE-2026-42506Medium
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
- CVE-2026-27136Medium
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
- CVE-2026-25681Medium
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
Original NVD description (English source)
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.