CVE-2025-22872

Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net

Medium · published April 16, 2025

CVSS v3.1
6.5
EPSS
1%
Percentile
44.9
In the wild
Unconfirmed
What it is

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00545 · 44.9th percentile
Published
2025-04-16T17:13Z
EPSS history
Timeline
  • 16 APR 17:13Z
    Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net
    cvelistv5