goldmark vulnerable to Cross-site Scripting (XSS)
Date: 2026-04
Affected: go/github.com/yuin/goldmark/renderer/html
Attack vector: xss
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2026-5160
CWE: CWE-79
CVSS: 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

Versions of the package github.com/yuin/goldmark/renderer/html before 1.7.17 are vulnerable to Cross-site Scripting (XSS) due to improper ordering of URL validation and normalization. The renderer validates link destinations using a prefix-based check (IsDangerousURL) before resolving HTML entities. This allows an attacker to bypass protocol filtering by encoding dangerous schemes using HTML5 named character references. For example, a payload such as javascript&colon;alert(1) is not recognized as dangerous during validation, leading to arbitrary script execution in the context of applications that render the URL.


Mitigations:

Architectural layers (MAESTRO):