The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade nerdctl-debuginfoUpgrade soci-snapshotterUpgrade runfinch-finchUpgrade ecs-initUpgrade amazon-cloudwatch-agentUpgrade amazon-ssm-agentUpgrade nerdctl | May 30, 2025 | Apr 16, 2025 |
| Amazon_linux_2023 | — | Upgrade nerdctlUpgrade soci-snapshotterUpgrade amazon-ssm-agentUpgrade amazon-cloudwatch-agentUpgrade ecs-initUpgrade runfinch-finch | Jun 3, 2025 | Apr 16, 2025 |
| Debian | — | Upgrade golang-golang-x-net | May 15, 2025 | Apr 16, 2025 |
| Dell Powerstore Dsa2025429 | — | Upgrade Dell PowerStoreOS to the latest version | Dec 3, 2025 | Dec 2, 2025 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 16, 2025 |
| Splunk | — | Upgrade Splunk Enterprise to version 10.2.3Upgrade Splunk Enterprise to version 10.2.1Upgrade Splunk Enterprise to version 9.4.9Upgrade Splunk Enterprise to version 9.3.10Upgrade Splunk Enterprise to version 9.3.12Upgrade Splunk Enterprise to version 9.4.11Upgrade Splunk Enterprise to version 10.0.4Upgrade Splunk Enterprise to version 10.0.6 | Jul 30, 2026 | Apr 16, 2025 |
| Suse | — | Upgrade kubernetes1.24-client-bash-completionUpgrade kubernetes1.25-clientUpgrade kubernetes1.25-kubeletUpgrade kubernetes1.27-controller-managerUpgrade kubevirt-manifestsUpgrade kubevirt-virt-apiUpgrade govulncheck-vulndbUpgrade kubernetes1.27-kubeadmUpgrade kubernetes1.27-kubelet-commonUpgrade kubernetes1.25-client-bash-completionUpgrade docker-zsh-completionUpgrade helm-fish-completionUpgrade kubernetes1.25-kubelet-commonUpgrade docker-stable-fish-completionUpgrade kubernetes1.23-client-bash-completionUpgrade kubernetes1.24-clientUpgrade kuboUpgrade kubernetes1.28-client-commonUpgrade docker-stableUpgrade kubernetes1.24-proxyUpgrade kubevirt-virt-handlerUpgrade kubernetes1.23-clientUpgrade kubernetes1.23-proxyUpgrade kubevirt-container-diskUpgrade kubevirt-virt-launcherUpgrade kubernetes1.23-apiserverUpgrade kubernetes1.24-schedulerUpgrade kubernetes1.31-client-commonUpgrade kubernetes1.27-client-bash-completionUpgrade kubernetes1.23-kubeletUpgrade alloyUpgrade kubernetes1.25-client-fish-completionUpgrade kubernetes1.27-kubeletUpgrade kubernetes1.23-kubeadmUpgrade helm-bash-completionUpgrade kubernetes1.24-kubelet-commonUpgrade kubernetes1.25-apiserverUpgrade grafanaUpgrade kubernetes1.26-controller-managerUpgrade kubernetes1.23-kubelet-commonUpgrade kubernetes1.26-kubeletUpgrade kubernetes1.25-client-commonUpgrade kubernetes1.27-client-commonUpgrade kubevirt-testsUpgrade kubernetes1.26-kubeadmUpgrade kubernetes1.25-proxyUpgrade kubevirt-virtctlUpgrade kubernetes1.24-kubeadmUpgrade kubernetes1.31-client-bash-completionUpgrade kubernetes1.26-kubelet-commonUpgrade kubernetes1.27-client-fish-completionUpgrade obs-service-kubevirt_containers_metaUpgrade go-sendxmppUpgrade kubernetes1.25-schedulerUpgrade kubernetes1.23-client-fish-completionUpgrade docker-fish-completionUpgrade docker-buildxUpgrade dockerUpgrade kubernetes1.26-schedulerUpgrade kubernetes1.23-client-commonUpgrade kubernetes1.24-controller-managerUpgrade kubernetes1.26-client-commonUpgrade docker-stable-rootless-extrasUpgrade docker-stable-zsh-completionUpgrade kubevirt-virt-controllerUpgrade kubernetes1.27-clientUpgrade kubevirt-virt-exportproxyUpgrade kubevirt-pr-helper-confUpgrade golang-github-prometheus-node_exporterUpgrade kubernetes1.23-schedulerUpgrade kubernetes1.23-controller-managerUpgrade helmUpgrade glowUpgrade kubernetes1.26-clientUpgrade kubernetes1.24-apiserverUpgrade kubernetes1.25-kubeadmUpgrade kubernetes1.27-proxyUpgrade kubernetes1.26-client-fish-completionUpgrade kubernetes1.24-client-fish-completionUpgrade kubernetes1.27-apiserverUpgrade kubernetes1.26-client-bash-completionUpgrade kubernetes1.25-controller-managerUpgrade kubernetes1.24-kubeletUpgrade kubernetes1.24-client-commonUpgrade prometheus-blackbox_exporterUpgrade kubevirt-virt-exportserverUpgrade kubernetes1.31-clientUpgrade docker-rootless-extrasUpgrade kubernetes1.28-clientUpgrade docker-bash-completionUpgrade kubernetes1.27-schedulerUpgrade helm-zsh-completionUpgrade docker-stable-bash-completionUpgrade kubevirt-virt-operatorUpgrade kubernetes1.26-proxyUpgrade kubernetes1.26-apiserver | Dec 5, 2025 | Jun 13, 2025 |
| Ubuntu | — | Upgrade lxd (Ubuntu Pro)Upgrade lxd-tools (Ubuntu Pro)Upgrade lxc2 (Ubuntu Pro)Upgrade golang-golang-x-net-dev (Ubuntu Pro)Upgrade juju-2.0 (Ubuntu Pro)Upgrade juju (Ubuntu Pro)Upgrade golang-github-lxc-lxd-dev (Ubuntu Pro)Upgrade lxd-client (Ubuntu Pro)Upgrade golang-go.net-dev (Ubuntu Pro)Upgrade adsys (Ubuntu Pro)Upgrade adsys-windows (Ubuntu Pro) | Mar 13, 2026 | Apr 16, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub