CVE-2026-52846: Caddy: stripHTML template function bypass

June 16, 2026

Caddy’s stripHTML template function cannot reliably remove all HTML tags from input strings. Certain malformed HTML, such as <<>img src=x onerror=alert()>, can bypass the tag-stripping logic, potentially leaving dangerous content in the output if it is later rendered as HTML. This may allow client-side XSS in cases where untrusted strings are rendered unsafely.

References

github.com/advisories/GHSA-vcc4-2c75-vc9v
github.com/caddyserver/caddy/security/advisories/GHSA-vcc4-2c75-vc9v
nvd.nist.gov/vuln/detail/CVE-2026-52846

Code Behaviors & Features

Detect and mitigate CVE-2026-52846 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →