CVE-2026-42502
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
- Affected products
- Alloy, Apko, Application-Gateway-Kubernetes-Ingress, Argo Cd, Argo Workflows, Azl-Otel-Collector, Buildah, Cadvisor
- Golang Net
- < 0.55.0
- CVSS 3.1
- 6.1 MEDIUM
- EPSS
- 0.2% (13th percentile)
- Weakness
- CWE-1021
- NVD status
- Analyzed
- Published
- 2026-05-22
CVE-2026-42502 at NVD
No indexed exploits for CVE-2026-42502 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2026-42502 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.