CVE ID :CVE-2026-5160 Published : April 15, 2026, 5 a.m. | 1 hour, 27 minutes ago Description :Versions of the package github.com/yuin/goldmark/renderer/html before 1.7.17 are vulnerable to Cross-site Scripting (XSS) due to improper ordering of URL validation and normalization. The renderer validates link destinations using a prefix-based check (IsDangerousURL) before resolving HTML entities. This allows an attacker to bypass protocol filtering by encoding dangerous schemes using HTML5 named character references. For example, a payload such as javascript:alert(1) is not recognized as dangerous during validation, leading to arbitrary script execution in the context of applications that render the URL. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...