CVE-2025-22872

Description

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).

Reserved 2025-01-08 | Published 2025-04-16 | Updated 2025-05-16 | Assigner Go

Problem types

CWE-79

Product status

Default status
unaffected

Any version before 0.38.0
affected

Credits

Sean Ng (https://ensy.zip)

References

go.dev/cl/662715

go.dev/issue/73070

groups.google.com/g/golang-announce/c/ezSKR9vqbqA

pkg.go.dev/vuln/GO-2025-3595

cve.org (CVE-2025-22872)

nvd.nist.gov (CVE-2025-22872)

Download JSON