The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).
History

Fri, 16 May 2025 23:45:00 +0000

Type Values Removed Values Added
References

Thu, 17 Apr 2025 14:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-79
References
Metrics threat_severity

None

threat_severity

Moderate


Wed, 16 Apr 2025 21:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


Wed, 16 Apr 2025 17:30:00 +0000

Type Values Removed Values Added
Description The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).
Title Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net
References

cve-icon MITRE

Status: PUBLISHED

Assigner: Go

Published:

Updated: 2025-05-16T23:03:07.693Z

Reserved: 2025-01-08T19:11:42.834Z

Link: CVE-2025-22872

cve-icon Vulnrichment

Updated: 2025-05-16T23:03:07.693Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-04-16T18:16:04.183

Modified: 2025-05-16T23:15:19.707

Link: CVE-2025-22872

cve-icon Redhat

Severity : Moderate

Publid Date: 2025-04-16T17:13:02Z

Links: CVE-2025-22872 - Bugzilla