XSS Vulnerability in Goldmark HTML Renderer by Yuin

CVE-2026-5160

What is CVE-2026-5160?

The Goldmark HTML renderer, prior to version 1.7.17, exhibits a Cross-site Scripting (XSS) vulnerability resulting from improper URL validation and normalization. An attacker can exploit this weakness by encoding dangerous URL schemes using HTML5 named character references, allowing for the execution of arbitrary scripts in applications that render URLs. This occurs because the renderer performs validation through a prefix-based check before properly resolving HTML entities, enabling attacks such as javascript:alert(1) to be executed in unsuspecting contexts.

References