The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade nerdctl-debuginfoUpgrade soci-snapshotterUpgrade runfinch-finchUpgrade amazon-cloudwatch-agentUpgrade nerdctlUpgrade amazon-ssm-agentUpgrade ecs-init | May 30, 2025 | Apr 16, 2025 |
| Amazon_linux_2023 | — | Upgrade amazon-cloudwatch-agentUpgrade ecs-initUpgrade runfinch-finchUpgrade soci-snapshotterUpgrade amazon-ssm-agentUpgrade nerdctl | Jun 3, 2025 | Apr 16, 2025 |
| Debian | — | No solution existsUpgrade golang-golang-x-net | May 15, 2025 | Apr 16, 2025 |
| Dell Powerstore Dsa2025429 | — | Upgrade Dell PowerStoreOS to the latest version | Dec 3, 2025 | Dec 2, 2025 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 16, 2025 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.4.11Upgrade Splunk Enterprise to version 10.0.4Upgrade Splunk Enterprise to version 9.3.10Upgrade Splunk Enterprise to version 9.3.12Upgrade Splunk Enterprise to version 10.0.6Upgrade Splunk Enterprise to version 9.4.9Upgrade Splunk Enterprise to version 10.2.3Upgrade Splunk Enterprise to version 10.2.1 | Jul 30, 2026 | Apr 16, 2025 |
| Suse | — | Upgrade kubernetes1.23-apiserverUpgrade kubernetes1.25-proxyUpgrade kubernetes1.26-kubeadmUpgrade kubernetes1.27-kubeletUpgrade kubernetes1.31-client-commonUpgrade kubernetes1.25-client-fish-completionUpgrade docker-zsh-completionUpgrade kubernetes1.24-client-bash-completionUpgrade kubernetes1.25-client-bash-completionUpgrade kubernetes1.23-kubeletUpgrade kubernetes1.25-kubeletUpgrade kubernetes1.27-controller-managerUpgrade kubernetes1.25-clientUpgrade kubevirt-virt-apiUpgrade kubernetes1.23-kubeadmUpgrade govulncheck-vulndbUpgrade kubernetes1.24-kubelet-commonUpgrade kubernetes1.24-schedulerUpgrade kubernetes1.25-client-commonUpgrade kubevirt-virt-launcherUpgrade kubevirt-container-diskUpgrade docker-stable-fish-completionUpgrade kubernetes1.25-kubelet-commonUpgrade docker-stableUpgrade kubernetes1.27-kubeadmUpgrade kubernetes1.24-proxyUpgrade kubevirt-virt-handlerUpgrade kubernetes1.24-clientUpgrade kubernetes1.23-clientUpgrade kubernetes1.27-kubelet-commonUpgrade kubevirt-manifestsUpgrade kubernetes1.23-kubelet-commonUpgrade kubernetes1.25-apiserverUpgrade helm-bash-completionUpgrade kubernetes1.26-controller-managerUpgrade kuboUpgrade alloyUpgrade grafanaUpgrade kubernetes1.26-kubeletUpgrade kubernetes1.26-kubelet-commonUpgrade kubevirt-virtctlUpgrade kubernetes1.24-kubeadmUpgrade kubernetes1.27-client-fish-completionUpgrade kubernetes1.31-client-bash-completionUpgrade kubernetes1.23-proxyUpgrade kubernetes1.28-client-commonUpgrade kubernetes1.27-client-bash-completionUpgrade kubernetes1.27-client-commonUpgrade kubevirt-testsUpgrade helm-fish-completionUpgrade kubernetes1.23-client-bash-completionUpgrade kubernetes1.24-kubeletUpgrade kubernetes1.24-client-commonUpgrade kubevirt-virt-exportserverUpgrade docker-rootless-extrasUpgrade kubernetes1.25-controller-managerUpgrade go-sendxmppUpgrade kubernetes1.27-proxyUpgrade kubernetes1.26-client-bash-completionUpgrade kubernetes1.25-kubeadmUpgrade kubernetes1.26-client-fish-completionUpgrade docker-stable-bash-completionUpgrade kubernetes1.27-schedulerUpgrade kubernetes1.26-proxyUpgrade kubevirt-virt-operatorUpgrade kubernetes1.24-controller-managerUpgrade docker-stable-rootless-extrasUpgrade kubernetes1.23-schedulerUpgrade kubernetes1.23-controller-managerUpgrade helmUpgrade kubernetes1.26-clientUpgrade kubernetes1.24-apiserverUpgrade kubernetes1.26-client-commonUpgrade kubernetes1.23-client-commonUpgrade docker-bash-completionUpgrade helm-zsh-completionUpgrade glowUpgrade kubernetes1.24-client-fish-completionUpgrade kubernetes1.27-apiserverUpgrade obs-service-kubevirt_containers_metaUpgrade golang-github-prometheus-node_exporterUpgrade kubevirt-virt-exportproxyUpgrade kubevirt-pr-helper-confUpgrade docker-buildxUpgrade kubernetes1.26-schedulerUpgrade dockerUpgrade kubevirt-virt-controllerUpgrade kubernetes1.27-clientUpgrade kubernetes1.26-apiserverUpgrade kubernetes1.25-schedulerUpgrade kubernetes1.23-client-fish-completionUpgrade docker-stable-zsh-completionUpgrade docker-fish-completionUpgrade prometheus-blackbox_exporterUpgrade kubernetes1.31-clientUpgrade kubernetes1.28-client | Dec 5, 2025 | Jun 13, 2025 |
| Ubuntu | — | Upgrade lxc2 (Ubuntu Pro)Upgrade juju-2.0 (Ubuntu Pro)Upgrade lxd-tools (Ubuntu Pro)Upgrade lxd (Ubuntu Pro)Upgrade juju (Ubuntu Pro)Upgrade golang-golang-x-net-dev (Ubuntu Pro)Upgrade adsys-windows (Ubuntu Pro)Upgrade adsys (Ubuntu Pro)Upgrade lxd-client (Ubuntu Pro)Upgrade golang-go.net-dev (Ubuntu Pro)Upgrade golang-github-lxc-lxd-dev (Ubuntu Pro) | Mar 13, 2026 | Apr 16, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub