MEDIUM Go Project Vulnerability Alert

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. This can lead to incorrect DOM construction, particularly when tags are in foreign content contexts such as or . The issue arises when using the Tokenizer directly or through Parse functions.

Details

Severity Base Score CVE
MEDIUM 6.5 CVE-2025-22872

Exploitation

To exploit this vulnerability, an attacker can craft HTML content that includes tags with unquoted attribute values ending in a solidus character. By sending this content to a vulnerable application that uses the Go tokenizer, the attacker can manipulate the DOM structure, potentially leading to unexpected behavior or security issues.

Affected Products

  • Go Tokenizer: The core component that processes HTML and XML content, which is affected by the incorrect interpretation of self-closing tags.
  • Applications using Go’s Parse functions: Any application that relies on these functions for DOM construction may be impacted by this vulnerability.

Mitigation

To mitigate this vulnerability, developers should ensure that all attribute values in HTML tags are properly quoted. Additionally, updating to the latest version of the Go library that addresses this issue is recommended to prevent exploitation.

References