Threats affecting pkg:golang/html/template

CVE-2026-97030 is a cross-site scripting (XSS) vulnerability in the Go standard library's html/template package. It involves improper escaping of the 'yield' keyword in templates, where valid uses were not correctly escaped, potentially allowing injection of malicious scripts. The issue affects certain versions of the Go html/template package prior to 1.26.9 and between 1.27.0-0 and 1.27.2. The vulnerability has a medium severity with a CVSS score of 6.1.

CVE-2026-94448 is a medium severity cross-site scripting (XSS) vulnerability in the Go standard library's html/template package. The issue arises when JavaScript template literals contain consecutive expressions, causing improper context tracking and failure to reset state correctly. This flaw can lead to insufficient escaping of regular expression literals within templates, potentially allowing injection of malicious scripts.

Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.

CVE-2026-39826 is a medium severity cross-site scripting (XSS) vulnerability in the Go standard library's html/template package. It occurs when a trusted template author includes a <script> tag with an empty or whitespace-only 'type' attribute, leading to improper escaping of data inside the script block. This can allow injection of malicious scripts if untrusted data is passed into the template. The vulnerability affects Go versions up to and including 1.26.0-0. There is no official patch or remediation guidance available, and no known exploits have been reported in the wild.

CVE-2026-39823 is a medium severity cross-site scripting (XSS) vulnerability in the Go standard library's html/template package. The issue arises from improper escaping of URLs within a <meta> tag's content attribute when ASCII whitespaces surround the '=' character, which allows partial bypass of escaping. This affects Go versions up to 1.26.0-0. No official patch or remediation guidance has been confirmed by the vendor, and no known exploits exist in the wild at this time.

CVE-2026-32289 is a medium severity cross-site scripting (XSS) vulnerability in the Go standard library's html/template package. It arises from improper escaping of content within JavaScript template literals due to incorrect context tracking and brace depth handling. This flaw can lead to XSS when template branches are used. The vulnerability affects Go versions up to and including 1.26.0-0. No official patch or remediation guidance is currently available, and no known exploits have been reported in the wild.

CVE-2026-27142 is a medium severity cross-site scripting (XSS) vulnerability in the Go standard library's html/template package. It occurs because URLs inserted into the content attribute of HTML meta tags are not properly escaped when the meta tag includes an http-equiv attribute with the value "refresh". This improper neutralization can allow an attacker to inject malicious scripts. A new GODEBUG setting, htmlmetacontenturlescape, has been introduced to control escaping behavior for URLs in meta content attributes. No official patch or fix details are provided in the available data.