Threats affecting pkg:golang/github.com/golang/go/html/template

CVE-2026-39826 is a medium severity cross-site scripting (XSS) vulnerability in the Go standard library's html/template package. It occurs when a trusted template author includes a <script> tag with an empty or whitespace-only 'type' attribute, leading to improper escaping of data inside the script block. This can allow injection of malicious scripts if untrusted data is passed into the template. The vulnerability affects Go versions up to and including 1.26.0-0. There is no official patch or remediation guidance available, and no known exploits have been reported in the wild.

CVE-2026-39823 is a medium severity cross-site scripting (XSS) vulnerability in the Go standard library's html/template package. The issue arises from improper escaping of URLs within a <meta> tag's content attribute when ASCII whitespaces surround the '=' character, which allows partial bypass of escaping. This affects Go versions up to 1.26.0-0. No official patch or remediation guidance has been confirmed by the vendor, and no known exploits exist in the wild at this time.