This vulnerability in the Go standard library html/template package involves improper neutralization of input during web page generation, specifically within JavaScript template literals. The context tracking mechanism fails to correctly handle branches and brace depth, resulting in incorrect escaping of template actions. This flaw can cause cross-site scripting (CWE-79) vulnerabilities when untrusted data is embedded in templates. The affected versions include all releases up to 1.26.0-0. The vulnerability was published on April 8, 2026, but no patch or official remediation level has been disclosed by the vendor. The Go html/template package is not a cloud service, so remediation depends on updating the library in affected applications.

If exploited, this vulnerability could allow an attacker to inject malicious JavaScript code into web pages generated by applications using the affected versions of the Go html/template package. This could lead to cross-site scripting attacks, potentially compromising user sessions, stealing sensitive information, or performing unauthorized actions in the context of the victim's browser. However, no known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround has been disclosed, users of the Go html/template package should monitor the Go project advisories for updates. In the meantime, careful review and sanitization of input data before rendering in templates is recommended to reduce risk.