Ali Sherif

On Darwin, building a malicious package using cgo can lead to arbitrary code execution when utilizing the Apple linker. This occurs when a `#cgo LDFLAGS` directive passes `-l to library <path>`, causing the Apple linker to recombine these arguments into `-lto library`. This process results in the loading of an arbitrary LTO (Link Time Optimization) plugin dynamic library during the linking phase.

An issue exists in `childTextNodesAreLiteral` where the process of walking up the tree stopped at the nearest foreign ancestor after finding an HTML integration point. This behavior is problematic when the integration point is a descendant of an element foster-parented into a foreign namespace, such as `<mglyph>` or `<malignmark>` under `<mtext>`. This can lead a parser to resolve the subtree in an incorrect foreign namespace when re-parsing the rendered output.

The HTTP/2 server incorrectly refunds connection-level flow control twice for the same data. This occurs when a client resets a stream, refunding data for the sent-but-unread portion, and again when a request handler reads that buffered data. A malicious client can use this behavior to bypass the `MaxReceiveBufferPerConnection` connection-level flow control limit. Total buffered data remains limited by the stream-level flow control and the concurrent stream limit.

Pathological inputs can cause an unescaped '/' to close prematurely. This allows attack-controlled data to inject arbitrary content, which may lead to Cross-Site Scripting (XSS), a technique where malicious scripts are injected into trusted websites.