---
id: CVE-2026-97045
aliases:
  - GO-2026-6866
title: >-
  Check all ancestor namespace transitions when rendering raw text in html in
  golang.org/x/net
summary: >-
  Check all ancestor namespace transitions when rendering raw text in html in
  golang.org/x/net
severity: none
vendor: x
product: golang.org/x/net
ecosystem: go
affected:
  - golang.org/x/net < 0.62.0
patched:
  - golang.org/x/net 0.62.0
published: '2026-10-27'
updated: '2026-10-27'
sourceUpdated: '2026-10-27T21:45:08.978077289Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GO-2026-6866'
references:
  - url: 'https://go.dev/cl/855121'
  - url: 'https://go.dev/issue/82622'
  - url: 'https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs'
  - url: 'https://pkg.go.dev/vuln/GO-2026-6866'
tags:
  - osv
  - go
  - cve.org
epss: 0.00202
epssPercentile: 0.10065
cwe:
  - CWE-79
ingestedAt: '2026-10-27T21:58:08.745Z'
---

## Overview

In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as <mglyph> or <malignmark> fostered under <mtext>), causing a parser to resolve the subtree in a different foreign namespace upon re-parsing the rendered output.

Continue walking the full ancestor chain and verify that every transition from a non-empty namespace occurs at an HTML integration point before emitting literal text.

## Affected packages

- `golang.org/x/net < 0.62.0`

## Remediation

Upgrade to a patched release:

- `golang.org/x/net 0.62.0`