CVE-2026-5160

The goldmark HTML renderer (versions before 1.7.17) contains a cross-site scripting vulnerability stemming from improper validation ordering. The flaw allows attackers to bypass protocol filtering through HTML entity encoding, enabling execution of arbitrary JavaScript in applications using affected versions of the github.com/yuin/goldmark/renderer/html package. This impacts any system that renders markdown content with this library without proper input sanitization. The vulnerability presents a network-exploitable attack requiring no privileges and minimal complexity, though user interaction is necessary for exploitation. The CVSS 3.1 score of 6.1 (Medium) reflects low confidentiality and integrity impacts with no availability impact. The EPSS score of 0.0004 suggests minimal active exploitation likelihood relative to the broader CVE landscape. Currently, this vulnerability shows no signs of active exploitation in the wild and does not appear on the CISA Known Exploited Vulnerabilities catalog. Community attention remains limited, as indicated by the moderate FAUCET risk score of 43.0/100. Organizations should prioritize patching to version 1.7.17 or later, particularly for internet-facing applications that process untrusted markdown content.