The vulnerability arises from the Go html/template package's failure to properly track context across template branches and brace depth within JavaScript template literals. This results in incorrect or improper escaping of template actions, potentially enabling cross-site scripting (CWE-79). The issue affects Go versions from 0 up to 1.26.0-0. The CVSS 3.1 base score is 6.1, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, user interaction needed, and partial impact on confidentiality and integrity. No vendor advisory or patch links are currently available.

Successful exploitation could allow an attacker to inject malicious scripts into web pages generated using the vulnerable html/template package, potentially leading to partial confidentiality and integrity compromise through cross-site scripting. There is no indication of availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, developers should carefully review and sanitize template inputs, especially when using JavaScript template literals with branches. Avoid relying solely on the html/template package's escaping for untrusted input in these contexts.