CVE-2026-5160
Description
A flaw was found in github.com/yuin/goldmark/renderer/html. This Cross-site Scripting (XSS) vulnerability allows a remote attacker to execute arbitrary scripts in the context of applications that render a malicious URL. The flaw stems from an improper ordering of URL validation and normalization, where the component validates link destinations before resolving HTML entities. This enables an attacker to bypass protocol filtering by encoding dangerous schemes using HTML5 named character references, leading to unauthorized code execution.
Statement
This vulnerability is rated as Moderate as user interaction is required by accessing the maliciously crafted content in order to an attacker perform the exploit. A Cross-site Scripting (XSS) flaw exists in github.com/yuin/goldmark/renderer/html due to incorrect ordering of URL validation and HTML entity resolution. This allows an attacker to bypass protocol filtering by encoding dangerous schemes, leading to arbitrary script execution when a malicious URL is rendered.
Mitigation
To mitigate this vulnerability, avoid rendering untrusted content with applications utilizing `github.com/yuin/goldmark/renderer/html`. Ensure that all input processed by the affected component is thoroughly sanitized to prevent the injection of malicious HTML entities or dangerous URL schemes.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.1 | N/A | 6.1 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | Required | N/A | Required |
| Scope | Changed | N/A | Changed |
| Confidentiality | Low | N/A | Low |
| Integrity Impact | Low | N/A | Low |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
