The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade nerdctl-debuginfoUpgrade soci-snapshotterUpgrade ecs-initUpgrade nerdctlUpgrade runfinch-finchUpgrade amazon-ssm-agentUpgrade amazon-cloudwatch-agent | May 30, 2025 | Apr 16, 2025 |
| Amazon_linux_2023 | — | Upgrade amazon-ssm-agentUpgrade soci-snapshotterUpgrade nerdctlUpgrade runfinch-finchUpgrade ecs-initUpgrade amazon-cloudwatch-agent | Jun 3, 2025 | Apr 16, 2025 |
| Debian | — | Upgrade golang-golang-x-net | May 15, 2025 | Apr 16, 2025 |
| Dell Powerstore Dsa2025429 | — | Upgrade Dell PowerStoreOS to the latest version | Dec 3, 2025 | Dec 2, 2025 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 16, 2025 |
| Splunk | — | Upgrade Splunk Enterprise to version 10.2.3Upgrade Splunk Enterprise to version 9.4.9Upgrade Splunk Enterprise to version 10.2.1Upgrade Splunk Enterprise to version 10.0.6Upgrade Splunk Enterprise to version 9.3.12Upgrade Splunk Enterprise to version 9.4.11Upgrade Splunk Enterprise to version 10.0.4Upgrade Splunk Enterprise to version 9.3.10 | Jul 30, 2026 | Apr 16, 2025 |
| Suse | — | Upgrade helm-zsh-completionUpgrade docker-bash-completionUpgrade dockerUpgrade kubernetes1.24-kubeletUpgrade kubernetes1.26-proxyUpgrade kubernetes1.24-client-fish-completionUpgrade kubernetes1.27-apiserverUpgrade kubernetes1.25-kubeadmUpgrade kubevirt-virt-operatorUpgrade kubernetes1.25-controller-managerUpgrade kubernetes1.23-client-fish-completionUpgrade docker-rootless-extrasUpgrade go-sendxmppUpgrade docker-stable-bash-completionUpgrade kubernetes1.24-apiserverUpgrade kubernetes1.26-clientUpgrade kubernetes1.24-client-commonUpgrade kubevirt-virt-controllerUpgrade glowUpgrade docker-stable-zsh-completionUpgrade helmUpgrade kubernetes1.27-schedulerUpgrade kubernetes1.23-schedulerUpgrade kubernetes1.28-clientUpgrade kubevirt-virt-exportserverUpgrade kubernetes1.26-client-commonUpgrade docker-buildxUpgrade kubernetes1.24-controller-managerUpgrade kubevirt-pr-helper-confUpgrade docker-stable-rootless-extrasUpgrade kubernetes1.23-client-commonUpgrade kubernetes1.27-proxyUpgrade kubevirt-virt-exportproxyUpgrade kubernetes1.26-client-bash-completionUpgrade obs-service-kubevirt_containers_metaUpgrade kubernetes1.26-apiserverUpgrade kubernetes1.26-client-fish-completionUpgrade golang-github-prometheus-node_exporterUpgrade kubernetes1.31-clientUpgrade kubernetes1.27-clientUpgrade prometheus-blackbox_exporterUpgrade docker-fish-completionUpgrade kubernetes1.26-schedulerUpgrade kubernetes1.23-controller-managerUpgrade kubernetes1.25-schedulerUpgrade kubernetes1.25-kubeletUpgrade kubevirt-container-diskUpgrade kubernetes1.27-kubeletUpgrade kubernetes1.27-controller-managerUpgrade kubernetes1.25-clientUpgrade kubernetes1.24-client-bash-completionUpgrade kubevirt-virt-apiUpgrade docker-stableUpgrade kubevirt-virt-launcherUpgrade kubernetes1.24-schedulerUpgrade kubernetes1.23-apiserverUpgrade kubernetes1.25-client-commonUpgrade kubernetes1.27-kubeadmUpgrade kubevirt-manifestsUpgrade kubernetes1.27-client-fish-completionUpgrade kubernetes1.23-proxyUpgrade kubernetes1.26-kubelet-commonUpgrade kubernetes1.24-kubeadmUpgrade kubevirt-virtctlUpgrade kubernetes1.31-client-bash-completionUpgrade kubernetes1.24-kubelet-commonUpgrade kubernetes1.25-client-fish-completionUpgrade kubernetes1.25-client-bash-completionUpgrade kubernetes1.23-kubeletUpgrade kubernetes1.23-kubeadmUpgrade docker-zsh-completionUpgrade kubernetes1.31-client-commonUpgrade alloyUpgrade grafanaUpgrade kuboUpgrade kubernetes1.27-client-bash-completionUpgrade kubernetes1.26-kubeletUpgrade kubernetes1.26-controller-managerUpgrade kubernetes1.25-apiserverUpgrade kubernetes1.23-kubelet-commonUpgrade helm-bash-completionUpgrade kubernetes1.28-client-commonUpgrade kubernetes1.25-kubelet-commonUpgrade helm-fish-completionUpgrade docker-stable-fish-completionUpgrade kubernetes1.23-client-bash-completionUpgrade kubevirt-testsUpgrade kubernetes1.27-client-commonUpgrade kubernetes1.23-clientUpgrade kubevirt-virt-handlerUpgrade kubernetes1.27-kubelet-commonUpgrade kubernetes1.24-clientUpgrade kubernetes1.24-proxyUpgrade kubernetes1.26-kubeadmUpgrade kubernetes1.25-proxyUpgrade govulncheck-vulndb | Dec 5, 2025 | Jun 13, 2025 |
| Ubuntu | — | Upgrade golang-golang-x-net-dev (Ubuntu Pro)Upgrade lxc2 (Ubuntu Pro)Upgrade juju (Ubuntu Pro)Upgrade lxd-tools (Ubuntu Pro)Upgrade lxd (Ubuntu Pro)Upgrade juju-2.0 (Ubuntu Pro)Upgrade lxd-client (Ubuntu Pro)Upgrade adsys-windows (Ubuntu Pro)Upgrade golang-go.net-dev (Ubuntu Pro)Upgrade golang-github-lxc-lxd-dev (Ubuntu Pro)Upgrade adsys (Ubuntu Pro) | Mar 13, 2026 | Apr 16, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub