Spotted what might be an issue in protoc-gen-go-redact/go.mod around line 1.
The golang.org/x/net package version v0.52.0 contains a bug in net/html where parsing arbitrary HTML can generate an unexpected tree, enabling XSS via crafted input. This repository depends on that version. Updating to v0.55.0 or later fixes the vulnerability.
Something like this might fix it:
--- a/protoc-gen-go-redact/go.mod
+++ b/protoc-gen-go-redact/go.mod
@@
-require golang.org/x/net v0.52.0
+require golang.org/x/net v0.55.0
For reference: rule CVE-2026-27136. Rated high.
The suggested change is untested against this project, so please read it before applying it.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.
Spotted what might be an issue in
protoc-gen-go-redact/go.modaround line 1.The golang.org/x/net package version v0.52.0 contains a bug in net/html where parsing arbitrary HTML can generate an unexpected tree, enabling XSS via crafted input. This repository depends on that version. Updating to v0.55.0 or later fixes the vulnerability.
Something like this might fix it:
For reference: rule
CVE-2026-27136. Rated high.The suggested change is untested against this project, so please read it before applying it.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.