Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2025-22872

Good to know:

icon

Date: April 16, 2025

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).

Severity Score

Related Resources (8)

https://go.dev/cl/662715
https://groups.google.com/g/golang-announce/c/ezSKR9vqbqA
https://pkg.go.dev/vuln/GO-2025-3595
https://security.netapp.com/advisory/ntap-20250516-0007/
https://nvd.nist.gov/vuln/detail/CVE-2025-22872
https://go.dev/issue/73070
https://security.netapp.com/advisory/ntap-20250516-0007
https://www.mend.io/vulnerability-database/CVE-2025-22872

Severity Score

Weakness Type (CWE)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-79

Top Fix

icon

Upgrade Version

Upgrade to version github.com/golang/net - v0.38.0;golang.org/x/net - v0.38.0;https://github.com/golang/net.git - v0.38.0

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): HIGH
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): CHANGED
Confidentiality (C): LOW
Integrity (I): LOW
Availability (A): LOW

Do you need more information?

Contact Us