The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade runfinch-finchUpgrade ecs-initUpgrade amazon-ssm-agentUpgrade amazon-cloudwatch-agentUpgrade nerdctlUpgrade nerdctl-debuginfoUpgrade soci-snapshotter | May 30, 2025 | Apr 16, 2025 |
| Amazon_linux_2023 | — | Upgrade soci-snapshotterUpgrade nerdctlUpgrade amazon-ssm-agentUpgrade runfinch-finchUpgrade amazon-cloudwatch-agentUpgrade ecs-init | Jun 3, 2025 | Apr 16, 2025 |
| Debian | — | No solution existsUpgrade golang-golang-x-net | May 15, 2025 | Apr 16, 2025 |
| Dell Powerstore Dsa2025429 | — | Upgrade Dell PowerStoreOS to the latest version | Dec 3, 2025 | Dec 2, 2025 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 16, 2025 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.3.12Upgrade Splunk Enterprise to version 10.0.6Upgrade Splunk Enterprise to version 9.4.11Upgrade Splunk Enterprise to version 9.3.10Upgrade Splunk Enterprise to version 10.0.4Upgrade Splunk Enterprise to version 10.2.1Upgrade Splunk Enterprise to version 9.4.9Upgrade Splunk Enterprise to version 10.2.3 | Jul 30, 2026 | Apr 16, 2025 |
| Suse | — | Upgrade kubernetes1.26-kubeadmUpgrade kubernetes1.27-client-commonUpgrade kubernetes1.26-controller-managerUpgrade kubernetes1.25-proxyUpgrade kubernetes1.23-client-bash-completionUpgrade kubernetes1.23-kubelet-commonUpgrade docker-stable-fish-completionUpgrade helm-fish-completionUpgrade kubernetes1.25-kubelet-commonUpgrade kubernetes1.28-client-commonUpgrade kubernetes1.25-apiserverUpgrade kubernetes1.26-kubeletUpgrade kubernetes1.27-client-bash-completionUpgrade kuboUpgrade alloyUpgrade kubernetes1.27-controller-managerUpgrade kubernetes1.27-kubeadmUpgrade kubernetes1.24-client-bash-completionUpgrade kubevirt-manifestsUpgrade kubernetes1.27-kubelet-commonUpgrade kubernetes1.31-client-bash-completionUpgrade govulncheck-vulndbUpgrade kubevirt-virt-apiUpgrade kubernetes1.24-clientUpgrade kubevirt-virt-handlerUpgrade helm-bash-completionUpgrade kubernetes1.23-clientUpgrade grafanaUpgrade kubernetes1.24-proxyUpgrade kubernetes1.25-clientUpgrade kubernetes1.23-kubeadmUpgrade kubevirt-testsUpgrade kubernetes1.25-client-commonUpgrade kubernetes1.23-proxyUpgrade kubernetes1.27-kubeletUpgrade kubernetes1.26-kubelet-commonUpgrade kubernetes1.27-client-fish-completionUpgrade kubevirt-virtctlUpgrade kubernetes1.24-kubelet-commonUpgrade docker-zsh-completionUpgrade kubernetes1.23-kubeletUpgrade kubernetes1.25-kubeletUpgrade kubernetes1.31-client-commonUpgrade kubernetes1.24-kubeadmUpgrade kubernetes1.25-client-fish-completionUpgrade kubevirt-container-diskUpgrade kubernetes1.25-client-bash-completionUpgrade kubevirt-virt-launcherUpgrade docker-stableUpgrade kubernetes1.23-apiserverUpgrade kubernetes1.24-schedulerUpgrade kubernetes1.24-apiserverUpgrade kubernetes1.26-client-bash-completionUpgrade kubernetes1.26-clientUpgrade kubernetes1.23-client-commonUpgrade kubernetes1.26-client-commonUpgrade kubernetes1.24-client-fish-completionUpgrade kubernetes1.27-apiserverUpgrade obs-service-kubevirt_containers_metaUpgrade kubevirt-virt-exportproxyUpgrade kubevirt-pr-helper-confUpgrade golang-github-prometheus-node_exporterUpgrade dockerUpgrade kubevirt-virt-controllerUpgrade prometheus-blackbox_exporterUpgrade go-sendxmppUpgrade docker-rootless-extrasUpgrade kubernetes1.31-clientUpgrade kubernetes1.28-clientUpgrade kubernetes1.25-controller-managerUpgrade kubernetes1.24-kubeletUpgrade kubernetes1.24-client-commonUpgrade kubevirt-virt-exportserverUpgrade kubernetes1.26-proxyUpgrade kubernetes1.27-schedulerUpgrade helm-zsh-completionUpgrade docker-stable-bash-completionUpgrade docker-bash-completionUpgrade kubevirt-virt-operatorUpgrade kubernetes1.26-schedulerUpgrade kubernetes1.26-apiserverUpgrade kubernetes1.27-clientUpgrade kubernetes1.23-client-fish-completionUpgrade docker-stable-zsh-completionUpgrade docker-fish-completionUpgrade docker-buildxUpgrade kubernetes1.25-schedulerUpgrade kubernetes1.27-proxyUpgrade kubernetes1.26-client-fish-completionUpgrade kubernetes1.25-kubeadmUpgrade kubernetes1.24-controller-managerUpgrade docker-stable-rootless-extrasUpgrade helmUpgrade kubernetes1.23-schedulerUpgrade kubernetes1.23-controller-managerUpgrade glow | Dec 5, 2025 | Jun 13, 2025 |
| Ubuntu | — | Upgrade juju-2.0 (Ubuntu Pro)Upgrade lxc2 (Ubuntu Pro)Upgrade juju (Ubuntu Pro)Upgrade lxd (Ubuntu Pro)Upgrade lxd-tools (Ubuntu Pro)Upgrade golang-golang-x-net-dev (Ubuntu Pro)Upgrade lxd-client (Ubuntu Pro)Upgrade adsys (Ubuntu Pro)Upgrade golang-go.net-dev (Ubuntu Pro)Upgrade golang-github-lxc-lxd-dev (Ubuntu Pro)Upgrade adsys-windows (Ubuntu Pro) | Mar 13, 2026 | Apr 16, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub