The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).
Metrics
Affected Vendors & Products
References
History
Fri, 16 May 2025 23:45:00 +0000
Type | Values Removed | Values Added |
---|---|---|
References |
|
Thu, 17 Apr 2025 14:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Weaknesses | CWE-79 | |
References |
| |
Metrics |
threat_severity
|
threat_severity
|
Wed, 16 Apr 2025 21:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Metrics |
cvssV3_1
|
Wed, 16 Apr 2025 17:30:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Description | The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts). | |
Title | Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net | |
References |
|

Status: PUBLISHED
Assigner: Go
Published:
Updated: 2025-05-16T23:03:07.693Z
Reserved: 2025-01-08T19:11:42.834Z
Link: CVE-2025-22872

Updated: 2025-05-16T23:03:07.693Z

Status : Awaiting Analysis
Published: 2025-04-16T18:16:04.183
Modified: 2025-05-16T23:15:19.707
Link: CVE-2025-22872
