This vulnerability in the Go standard library's html/template package involves improper neutralization of input during web page generation, specifically within JavaScript template literals. The root cause is incorrect context tracking and brace depth handling, which results in improper escaping of content. This can lead to cross-site scripting (CWE-79) vulnerabilities when template branches are utilized. The issue affects all Go versions up to 1.26.0-0. There is currently no official fix or remediation guidance from the vendor, and no known exploitation in the wild has been reported.

Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages generated using the affected html/template package, potentially leading to cross-site scripting attacks. This could result in limited confidentiality and integrity impacts, such as theft of user data or session hijacking. Availability is not impacted. However, no known exploits have been observed in the wild to date.

No official patch or remediation guidance is currently provided by the vendor. Users should monitor the official Go project advisories for updates. Until a fix is released, careful review and sanitization of template inputs and avoidance of risky template branches in JavaScript literals may reduce exposure.