CVE-2026-27136: XSS in golang.org/x/net/html on Azure

🟠 High  |  Source: Microsoft Security Response Center

CVE-2026-27136 is a Cross-Site Scripting (XSS) vulnerability in the Go standard library package golang.org/x/net/html, triggered by invoking duplicate HTML attributes during parsing. An attacker able to influence HTML content processed by an affected Go application could inject malicious scripts into users’ browsers. This is particularly relevant to cloud-hosted Go applications and services built on Azure that rely on this library for HTML handling.

Architect’s Take: Audit your Azure-hosted Go applications and container images for use of golang.org/x/net/html and update to the patched version immediately; also review your software composition analysis (SCA) tooling to ensure this transitive dependency is flagged across all pipelines.

Original advisory: CVE-2026-27136 Invoking duplicate attributes can cause XSS in golang.org/x/net/html