This vulnerability involves improper escaping of data passed into <script> blocks in Go's html/template package when the <script> tag has an empty or whitespace 'type' attribute. Under these conditions, the template engine fails to correctly neutralize input, leading to potential cross-site scripting attacks. The issue affects versions up to 1.26.0-0. No CVSS score or vendor advisory with patch information is currently available.

Successful exploitation could allow an attacker to inject and execute arbitrary scripts in the context of a web page generated by the vulnerable Go html/template package. This could lead to typical XSS impacts such as session hijacking or unauthorized actions performed by the victim's browser. However, exploitation requires the template author to write a <script> tag with the specific malformed 'type' attribute, limiting the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid using <script> tags with empty or whitespace-only 'type' attributes in templates authored with the Go html/template package.