The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade amazon-cloudwatch-agentUpgrade ecs-initUpgrade runfinch-finchUpgrade amazon-ssm-agentUpgrade nerdctlUpgrade nerdctl-debuginfoUpgrade soci-snapshotter | May 30, 2025 | Apr 16, 2025 |
| Amazon_linux_2023 | — | Upgrade ecs-initUpgrade amazon-cloudwatch-agentUpgrade runfinch-finchUpgrade nerdctlUpgrade soci-snapshotterUpgrade amazon-ssm-agent | Jun 3, 2025 | Apr 16, 2025 |
| Debian | — | Upgrade golang-golang-x-netNo solution exists | May 15, 2025 | Apr 16, 2025 |
| Dell Powerstore Dsa2025429 | — | Upgrade Dell PowerStoreOS to the latest version | Dec 3, 2025 | Dec 2, 2025 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 16, 2025 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.4.11Upgrade Splunk Enterprise to version 10.0.6Upgrade Splunk Enterprise to version 9.3.12Upgrade Splunk Enterprise to version 9.3.10Upgrade Splunk Enterprise to version 10.0.4Upgrade Splunk Enterprise to version 9.4.9Upgrade Splunk Enterprise to version 10.2.3Upgrade Splunk Enterprise to version 10.2.1 | Jul 30, 2026 | Apr 16, 2025 |
| Suse | — | Upgrade kubernetes1.25-kubelet-commonUpgrade kubevirt-virt-handlerUpgrade govulncheck-vulndbUpgrade kubernetes1.28-client-commonUpgrade docker-stable-fish-completionUpgrade helm-fish-completionUpgrade kubernetes1.25-clientUpgrade alloyUpgrade kubernetes1.25-apiserverUpgrade kuboUpgrade kubernetes1.26-controller-managerUpgrade kubernetes1.27-client-bash-completionUpgrade helm-bash-completionUpgrade grafanaUpgrade kubernetes1.23-kubeadmUpgrade kubernetes1.23-kubeletUpgrade docker-zsh-completionUpgrade kubernetes1.23-kubelet-commonUpgrade kubernetes1.27-kubeletUpgrade kubernetes1.31-client-commonUpgrade kubernetes1.26-kubeletUpgrade kubernetes1.27-client-commonUpgrade kubernetes1.26-kubelet-commonUpgrade kubernetes1.23-client-bash-completionUpgrade kubernetes1.24-kubelet-commonUpgrade kubernetes1.25-proxyUpgrade kubernetes1.26-kubeadmUpgrade kubevirt-testsUpgrade kubernetes1.25-client-bash-completionUpgrade kubernetes1.31-client-bash-completionUpgrade kubevirt-virtctlUpgrade kubernetes1.27-client-fish-completionUpgrade kubernetes1.23-proxyUpgrade kubernetes1.25-client-commonUpgrade kubernetes1.24-kubeadmUpgrade kubernetes1.25-client-fish-completionUpgrade kubernetes1.27-kubelet-commonUpgrade kubevirt-virt-launcherUpgrade kubernetes1.24-proxyUpgrade docker-stableUpgrade kubernetes1.27-kubeadmUpgrade kubernetes1.23-clientUpgrade kubernetes1.24-clientUpgrade kubernetes1.23-apiserverUpgrade kubernetes1.27-controller-managerUpgrade kubevirt-manifestsUpgrade kubernetes1.25-kubeletUpgrade kubernetes1.24-client-bash-completionUpgrade kubevirt-virt-apiUpgrade kubevirt-container-diskUpgrade kubernetes1.24-schedulerUpgrade kubernetes1.31-clientUpgrade helm-zsh-completionUpgrade docker-stable-bash-completionUpgrade kubernetes1.26-proxyUpgrade kubernetes1.27-apiserverUpgrade kubernetes1.24-client-fish-completionUpgrade kubernetes1.26-schedulerUpgrade kubernetes1.26-apiserverUpgrade kubernetes1.27-clientUpgrade kubernetes1.25-schedulerUpgrade kubernetes1.23-client-fish-completionUpgrade docker-stable-zsh-completionUpgrade docker-buildxUpgrade dockerUpgrade golang-github-prometheus-node_exporterUpgrade go-sendxmppUpgrade kubernetes1.24-client-commonUpgrade prometheus-blackbox_exporterUpgrade kubevirt-virt-exportserverUpgrade kubernetes1.28-clientUpgrade kubernetes1.25-controller-managerUpgrade kubernetes1.24-kubeletUpgrade docker-rootless-extrasUpgrade obs-service-kubevirt_containers_metaUpgrade kubevirt-virt-exportproxyUpgrade kubevirt-pr-helper-confUpgrade kubernetes1.23-client-commonUpgrade docker-stable-rootless-extrasUpgrade kubernetes1.24-controller-managerUpgrade kubernetes1.26-client-commonUpgrade kubernetes1.27-proxyUpgrade kubernetes1.26-client-fish-completionUpgrade kubernetes1.25-kubeadmUpgrade kubernetes1.26-client-bash-completionUpgrade kubevirt-virt-controllerUpgrade docker-fish-completionUpgrade glowUpgrade kubernetes1.23-schedulerUpgrade kubernetes1.26-clientUpgrade kubernetes1.24-apiserverUpgrade kubernetes1.23-controller-managerUpgrade helmUpgrade docker-bash-completionUpgrade kubevirt-virt-operatorUpgrade kubernetes1.27-scheduler | Dec 5, 2025 | Jun 13, 2025 |
| Ubuntu | — | Upgrade lxd-tools (Ubuntu Pro)Upgrade lxd (Ubuntu Pro)Upgrade juju-2.0 (Ubuntu Pro)Upgrade juju (Ubuntu Pro)Upgrade golang-golang-x-net-dev (Ubuntu Pro)Upgrade lxc2 (Ubuntu Pro)Upgrade adsys (Ubuntu Pro)Upgrade adsys-windows (Ubuntu Pro)Upgrade golang-go.net-dev (Ubuntu Pro)Upgrade lxd-client (Ubuntu Pro)Upgrade golang-github-lxc-lxd-dev (Ubuntu Pro) | Mar 13, 2026 | Apr 16, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub