Threat Intelligence Database

Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.

CVE-2026-39826 is a medium severity cross-site scripting (XSS) vulnerability in the Go standard library's html/template package. It occurs when a trusted template author includes a <script> tag with an empty or whitespace-only 'type' attribute, leading to improper escaping of data inside the script block. This can allow injection of malicious scripts if untrusted data is passed into the template. The vulnerability affects Go versions up to and including 1.26.0-0. There is no official patch or remediation guidance available, and no known exploits have been reported in the wild.

CVE-2026-39823 is a medium severity cross-site scripting (XSS) vulnerability in the Go standard library's html/template package. The issue arises from improper escaping of URLs within a <meta> tag's content attribute when ASCII whitespaces surround the '=' character, which allows partial bypass of escaping. This affects Go versions up to 1.26.0-0. No official patch or remediation guidance has been confirmed by the vendor, and no known exploits exist in the wild at this time.

CVE-2026-32289 is a medium severity cross-site scripting (XSS) vulnerability in the Go standard library's html/template package. It arises from improper escaping of content within JavaScript template literals due to incorrect context tracking and brace depth handling. This flaw can lead to XSS when template branches are used. The vulnerability affects Go versions up to and including 1.26.0-0. No official patch or remediation guidance is currently available, and no known exploits have been reported in the wild.

CVE-2026-27142 is a medium severity cross-site scripting (XSS) vulnerability in the Go standard library's html/template package. It occurs because URLs inserted into the content attribute of HTML meta tags are not properly escaped when the meta tag includes an http-equiv attribute with the value "refresh". This improper neutralization can allow an attacker to inject malicious scripts. A new GODEBUG setting, htmlmetacontenturlescape, has been introduced to control escaping behavior for URLs in meta content attributes. No official patch or fix details are provided in the available data.