VULNERABILITY INTELLIGENCE

CVE-2026-25681

CVSS score6.1 MEDIUM
EPSS probability0.22%
CISA KEVNot currently listed
Published2026-05-22
Last modified2026-07-23
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Description

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Weakness classification

  • CWE-1021: Improper Restriction of Rendered UI Layers or Frames

Primary references