CVE-2026-5160
Description
Versions of the package github.com/yuin/goldmark/renderer/html before 1.7.17 are vulnerable to Cross-site Scripting (XSS) due to improper ordering of URL validation and normalization. The renderer validates link destinations using a prefix-based check (IsDangerousURL) before resolving HTML entities. This allows an attacker to bypass protocol filtering by encoding dangerous schemes using HTML5 named character references. For example, a payload such as javascript:alert(1) is not recognized as dangerous during validation, leading to arbitrary script execution in the context of applications that render the URL.
How to fix
- yuin goldmark1.7.17 or later
- github.com/yuin/goldmark/renderer/html1.7.17 or later
- github.com/yuin/goldmark1.7.17 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| yuin goldmark | v < 1.7.17 | 1.7.17 |
| github.com/yuin/goldmark/renderer/htmlGo | v < 1.7.17 | 1.7.17 |
| github.com/yuin/goldmarkGo | v < 1.7.17 | 1.7.17 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.