CVE-2026-10618

A flaw was found in Hugo's default fenced-code-block renderer. This vulnerability allows a remote attacker to inject arbitrary script code into the rendered HTML by providing specially crafted input in the code-fence info string. Due to improper escaping of attribute values, a malicious quote can...

OPENSUSE-SU-2026:21480-1 Security update for mcphost

This update for mcphost fixes the following issues: - CVE-2026-5160: github.com/yuin/goldmark/renderer: Cross-site Scripting due to improper URL validation bsc1272488. - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and...

Security update for mcphost

This update for mcphost fixes the following issues: CVE-2026-5160: github.com/yuin/goldmark/renderer: Cross-site Scripting due to improper URL validation bsc1272488. CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and...

SUSE CVE-2026-5160

Versions of the package github.com/yuin/goldmark/renderer/html before 1.7.17 are vulnerable to Cross-site Scripting XSS due to improper ordering of URL validation and normalization. The renderer validates link destinations using a prefix-based check IsDangerousURL before resolving HTML entities...

GO-2026-5320 Cross-site Scripting (XSS) in github.com/yuin/goldmark

Cross-site Scripting XSS in github.com/yuin/goldmark...

Fedora 44 : gum (2026-10cf6ce616)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-10cf6ce616 advisory. Update vendored goldmark to 1.7.17 to resolve CVE-2026-5160. Tenable has extracted the preceding description block directly from the Fedora security advisory...

GHSA-C97M-VXHJ-P7J6 goldmark vulnerable to Cross-site Scripting (XSS)

Versions of the package github.com/yuin/goldmark/renderer/html before 1.7.17 are vulnerable to Cross-site Scripting XSS due to improper ordering of URL validation and normalization. The renderer validates link destinations using a prefix-based check IsDangerousURL before resolving HTML entities...

goldmark vulnerable to Cross-site Scripting (XSS)

Versions of the package github.com/yuin/goldmark/renderer/html before 1.7.17 are vulnerable to Cross-site Scripting XSS due to improper ordering of URL validation and normalization. The renderer validates link destinations using a prefix-based check IsDangerousURL before resolving HTML entities...

EUVD-2026-22836

Versions of the package github.com/yuin/goldmark/renderer/html before 1.7.17 are vulnerable to Cross-site Scripting XSS due to improper ordering of URL validation and normalization. The renderer validates link destinations using a prefix-based check IsDangerousURL before resolving HTML entities...

CVE-2026-5160

A flaw was found in github.com/yuin/goldmark/renderer/html. This Cross-site Scripting XSS vulnerability allows a remote attacker to execute arbitrary scripts in the context of applications that render a malicious URL. The flaw stems from an improper ordering of URL validation and normalization,...

Linux Distros Unpatched Vulnerability : CVE-2026-5160

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Versions of the package github.com/yuin/goldmark/renderer/html before 1.7.17 are vulnerable to Cross-site Scripting XSS due to improper ordering of URL validati...

AZL-83048 CVE-2026-5160 affecting package gh for versions less than 2.62.0-15

Versions of the package github.com/yuin/goldmark/renderer/html before 1.7.17 are vulnerable to Cross-site Scripting XSS due to improper ordering of URL validation and normalization. The renderer validates link destinations using a prefix-based check IsDangerousURL before resolving HTML entities...

AZL-83060 CVE-2026-5160 affecting package telegraf for versions less than 1.31.0-19

Versions of the package github.com/yuin/goldmark/renderer/html before 1.7.17 are vulnerable to Cross-site Scripting XSS due to improper ordering of URL validation and normalization. The renderer validates link destinations using a prefix-based check IsDangerousURL before resolving HTML entities...

CVE-2026-5160

Versions of the package github.com/yuin/goldmark/renderer/html before 1.7.17 are vulnerable to Cross-site Scripting XSS due to improper ordering of URL validation and normalization. The renderer validates link destinations using a prefix-based check IsDangerousURL before resolving HTML entities...

UBUNTU-CVE-2026-5160

Versions of the package github.com/yuin/goldmark/renderer/html before 1.7.17 are vulnerable to Cross-site Scripting XSS due to improper ordering of URL validation and normalization. The renderer validates link destinations using a prefix-based check IsDangerousURL before resolving HTML entities...

CVE-2026-5160

Versions of the package github.com/yuin/goldmark/renderer/html before 1.7.17 are vulnerable to Cross-site Scripting XSS due to improper ordering of URL validation and normalization. The renderer validates link destinations using a prefix-based check IsDangerousURL before resolving HTML entities...

CVE-2026-5160

Versions of the package github.com/yuin/goldmark/renderer/html before 1.7.17 are vulnerable to Cross-site Scripting XSS due to improper ordering of URL validation and normalization. The renderer validates link destinations using a prefix-based check IsDangerousURL before resolving HTML entities...

CVE-2026-5160

Summary: CVE-2026-5160 affects the Go package github.com/yuin/goldmark/renderer/html prior to 1.7.17, where cross-site scripting (XSS) can occur due to the order of URL validation and entity resolution. The renderer checks destinations with IsDangerousURL before HTML entity decoding, allowing an ...

CVE-2026-5160

Versions of the package github.com/yuin/goldmark/renderer/html before 1.7.17 are vulnerable to Cross-site Scripting XSS due to improper ordering of URL validation and normalization. The renderer validates link destinations using a prefix-based check IsDangerousURL before resolving HTML entities...

CVE-2026-5160

Versions of the package github.com/yuin/goldmark/renderer/html before 1.7.17 are vulnerable to Cross-site Scripting XSS due to improper ordering of URL validation and normalization. The renderer validates link destinations using a prefix-based check IsDangerousURL before resolving HTML entities...